VS Code extensions - Tool

Related Threat Clusters

• Ransomware Deployment via VS Code Extensions and GitHub C2 Exploited

  Threat actors are exploiting vulnerabilities in Visual Studio Code (VS Code) extensions to deploy ransomware, using GitHub as a command and control (C2) server. This tactic poses risks to developers and organizations…

  2 articles · Updated November 6, 2025
• Rogue MCP Servers Exploit Vulnerability in Cursor Code Editor

  Security researchers have identified a vulnerability in Cursor, an AI-powered code editor, that allows rogue Model Context Protocol (MCP) servers to inject malicious code into its internal browser. This exploit can…

  2 articles · Updated November 17, 2025
• Ransomware Deployment via VS Code Extensions and GitHub C2 Exploited by Threat Actors

  Threat actors are exploiting vulnerabilities in Visual Studio Code (VS Code) extensions to deploy ransomware, using GitHub as a command and control (C2) server. This attack method targets developers and organizations…

  2 articles · Updated November 6, 2025
• Rogue MCP Servers Exploit Vulnerability in Cursor's Internal Browser

  Hackers are exploiting a critical vulnerability in Cursor, an AI-powered code editor, by using compromised Model Context Protocol (MCP) servers to inject malicious code. This attack allows the rogue servers to…

  2 articles · Updated November 17, 2025

Recent Intelligence Reports

• Rogue MCP servers can take over Cursor’s built — Csoonline · November 13, 2025
• Threat Actors May Abuse VS Code Extensions to Deploy Ransomware and Use GitHub as C2 Server — Cybersecuritynews · November 6, 2025

Related Entities