Malicious VS Code Extension Delivers Anivia Loader and OctoRAT
Summary
Researchers analyzed a fake Prettier VS Code extension that delivered Anivia and OctoRAT through a multi-stage chain, enabling remote control, credential and data theft, persistence, and evasion. The extension was removed after several installs.
Key points
- The fake prettier-vscode-plus extension appeared on the official VS Code Marketplace on November 21, 2025, and was removed within four hours; the article reports six downloads and three installs.
- A VBScript dropper launched encrypted PowerShell payloads, leading to the Anivia loader and then OctoRAT.
- Anivia decrypted its payload in memory and used process hollowing to run it inside the legitimate Windows process vbc.exe.
- OctoRAT can steal browser credentials, cookies, autofill data, files, and cryptocurrency wallet data, and provides remote desktop, keylogging, and command execution.
- The malware uses scheduled-task persistence, attempts a FodHelper UAC bypass, and can disable Windows security controls.
- Researchers identified seven OctoRAT control panels using an HTML title fingerprint and reported a shared TLS certificate across 93 servers.
- The article provides detection opportunities, control-panel IPs, and hashes for the malware components.
Article Details
- Attack Vectors
- A fake Prettier extension, prettier-vscode-plus, was published to the official Visual Studio Code Marketplace and used to initiate a multi-stage malware chain.
- A VBScript dropper wrote and ran a PowerShell payload that decrypted and executed code in memory.
- The Anivia loader decrypted a payload and used process hollowing to run it inside vbc.exe.
- OctoRAT attempted a FodHelper UAC bypass and used a scheduled task named WindowsUpdate for persistence.
- OctoRAT harvested browser data and cryptocurrency-wallet data, then communicated with control-panel infrastructure identified in the article.
- Defensive Notes
- Monitor for installations of prettier-vscode-plus and unusual extension additions.
- Investigate repeated downloads from vague GitHub repositories such as vscode, especially when associated with VBScript or encrypted payloads.
- Detect suspicious vbc.exe activity, including unusual network connections or child processes that may indicate process hollowing.
- Monitor VBScript-launched PowerShell and Base64/AES-related execution patterns.
- Detect external servers returning the HTML title OctoRAT Center - Login and investigate the identified OctoRAT infrastructure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 158[.]94[.]210[.]52 | Identified OctoRAT control-panel server. |
| IPV4 | 158[.]94[.]210[.]76 | Identified OctoRAT control-panel server. |
| IPV4 | 178[.]16[.]55[.]109 | Host identified as running an active OctoRAT control panel. |
| IPV4 | 51[.]178[.]245[.]127 | Identified OctoRAT control-panel server. |
| IPV4 | 51[.]38[.]250[.]193 | Identified OctoRAT control-panel server. |
| IPV4 | 91[.]206[.]169[.]80 | Identified OctoRAT control-panel server. |
| SHA256 | 279f7ab5979e82caa75ac4d7923ee1f3d76fe8c3edc6cc124d619a8f7441eb5e | TLS certificate fingerprint associated with a cluster of OctoRAT infrastructure. |
| SHA256 | 360e6f2288b6c8364159e80330b9af83f2d561929d206bc1e1e5f1585432b28f | Hash of the OctoRAT payload identified in the campaign. |
| SHA256 | 9a870ca9b0a47c5b496a6e00eaaa68aec132dd0b778e7a1830dadf1e44660feb | Hash of the embedded PowerShell loader identified in the campaign. |
| SHA256 | b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2 | Hash of the Anivia loader identified in the campaign. |
| SHA256 | f4e5b1407f8a66f7563d3fb9cf53bae2dc3b1f1b93058236e68ab2bd8b42be9d | Hash of the VBScript dropper identified in the campaign. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelOctoRAT uploaded stolen browser data to its C2 server.T1053.005 · Scheduled TaskOctoRAT created a Windows scheduled task named WindowsUpdate to run every minute.T1055.012 · Process HollowingAnivia injected its decrypted payload into vbc.exe using process hollowing.T1056.001 · KeyloggingOctoRAT included a command to capture keystrokes.T1057 · Process DiscoveryOctoRAT included a command to list running processes.T1059.001 · PowerShellThe VBScript dropper launched PowerShell to decrypt and execute the payload.T1059.005 · Visual BasicThe initial dropper was a VBScript payload.T1071 · Application Layer ProtocolOctoRAT communicated with a configured C2 server and exchanged reconnaissance and heartbeat packets.T1082 · System Information DiscoveryOctoRAT sent system information, including the Windows version and build, in a reconnaissance packet.T1083 · File and Directory DiscoveryOctoRAT included commands to list directory contents and inspect file-system locations.T1113 · Screen CaptureOctoRAT could capture and stream the victim's screen.T1115 · Clipboard DataOctoRAT included commands to monitor clipboard data.T1195.002 · Compromise Software Supply ChainThe fake extension was published through the Visual Studio Code Marketplace and used to deliver the malware chain.T1548.002 · Bypass User Account ControlOctoRAT used the FodHelper UAC bypass by manipulating the ms-settings registry key.T1555 · Credentials from Password StoresThe article maps OctoRAT's collection of saved browser credentials to this technique.T1555.003 · Credentials from Web BrowsersOctoRAT extracted saved passwords and other data from browser databases.T1562.004 · Disable or Modify System FirewallOctoRAT could disable Windows Firewall across network profiles.T1564.001 · Hidden Files and DirectoriesOctoRAT could hide its executable by setting hidden and system file attributes.
Malware
Aniviato the official marketplace, used it to deliver a multi-stage malware chain, and ultimately deployed the Anivia loader followed by a fully featured RAT called OctoRAT. This infection path targets developers directlyOctoRATmalware chain, and ultimately deployed the Anivia loader followed by a fully featured RAT called OctoRAT. This infection path targets developers directly by blending into the tools they trust every day.
Vendors
GitHubIn late November 2025, our threat hunting team traced a series of suspicious VBScript payloads back to a GitHub repository using the handle biwwwwwwwwwww. What first looked like a harmless "vscode" repository turned outMicrosoftis named "vscode" a deliberate naming choice intended to blend in with legitimate projects related to Microsoft's widelyâused code editor. By mimicking a common and benign repository name, the actor reduces theRailnet LLCOne clear example is 178.16.55[.]109, a Railnet LLC host in the 178.16.55[.]0/24 range. On the infrastructure view for Railnet LLC, port 8000 is marked as an active OctoRAT control panel, sitting next to other exposed
Products
.NET FrameworkBy injecting a legitimate Microsoft-signed binary commonly present on systems with the .NET Framework installed into vbc.exe, the malware evades detection by security tools that rely on process reputation or applicationMicrosoft WindowsThe initial infection vector relies on a VBScript dropper that initializes two Windows COM objects to handle file operations and command execution. The script constructs a temporary file path using the Windows tempPrettierThe attacker pushed a fake Prettier extension to the official marketplace, used it to deliver a multi-stage malware chain, and ultimately deployed the Anivia loader followed by a fully featured RAT called OctoRAT. ThisVisual Studio Codea harmless "vscode" repository turned out to be the backbone of a supply-chain attack abusing the Visual Studio Code extension ecosystem.
Countries
Germanythreat actor infrastructureAnd it isn't limited to one region. The same fingerprint shows up on hosts in Germany (for example, the 91.92.240[.]x range) and the Netherlands (the 91.92.243[.]x range), all tied back toNetherlandsThe same fingerprint shows up on hosts in Germany (for example, the 91.92.240[.]x range) and the Netherlands (the 91.92.243[.]x range), all tied back to Railnet LLC inside Hunt.io.