Malicious VS Code Extension Impersonating Zoom Targets Chrome Cookies

Summary

Researchers found a VS Code extension posing as Zoom that added code to access Chrome cookies in version 0.2.2. It also contained hardcoded secrets for more than 20 services; the researchers reported it to Microsoft.

Key points

The extension impersonated Zoom Workspace and was uploaded to the VS Code Marketplace on November 30; its cookie-targeting code appeared in the December 8 update, version 0.2.2.
Its code attempts to read cookie data from the default Google Chrome profile’s SQLite database.
The extension contacts api.storagehb[.]cn; researchers received an HTTP 404 response from the endpoint.
A .env file contained hardcoded API keys and secrets for more than 20 services, including PayPal, GitHub, Mailgun, and AWS.
The article also identifies a possible delivery domain, zoom-communications.gallery[.]vsassets.io, and provides the VSIX filename and SHA-256 hash.
Researchers reported the extension to Microsoft’s VS Code Marketplace and advised users to vet extensions and limit their permissions.

Article Details

Attack Vectors: A malicious VS Code extension impersonated Zoom Workspace and was distributed through the VS Code Marketplace.
Version 0.2.2 accessed the Google Chrome Cookies database and queried stored cookie data.
The extension made an HTTPS request to an external endpoint described as a possible data-extraction endpoint.
Defensive Notes: Vet extensions through code audits, reputation checks, and user reviews before installing them.
Restrict extension permissions to those necessary for their function.
Train developers and users to recognize and report suspicious extensions.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`zoom-communications[.]gallery[.]vsassets[.]io`	Domain identified as possibly registered by the actor to deliver the malicious extension.
IPV4	`13[.]107[.]6[.]175`	IP listed alongside the domain possibly used to deliver the malicious extension.
SHA256	`5c89ba9e1bbb7ef869e4553081a40cabbd91a70506d759fd4e97eefb0434c074`	SHA-256 hash listed for the malicious Zoom-impersonating VSIX extension version 0.2.2.
URL	`hxxps[:]//api[.]storagehb[.]cn/d?v=1.3`	Endpoint found in extension-web.js and described as a possible data-extraction endpoint.