The VS Code extension ascii-fetcher.ascii-fetcher looked harmless because almost all of its code lived in a dependency. That dependency, @jaymara/jsononifier, XOR-decodes a hidden Windows command and executes it after anti-analysis guards.
Read Full Briefing
Threat Intel
In late June Argus caught a cluster of VS Code: droppers that all abused Windows installer primitives — curl|bash, irm|iex, cscript, msht...
Read Briefing
Malware Analysis
The worldline.aicodefix campaign downloads a counterfeit VCRUNTIME140.dll from a fake Microsoft domain, plants it inside a spoofed Edge u...
Read Briefing
Malware Analysis
The DigitalBarberTrim.html-entity-codec campaign version-cycled through clean, malicious, and stub releases. The payload was a hidden i.j...
Read Briefing
Threat Intel
A fake Solidity language extension hid in VS Code: for weeks before activating. Once it did, it scraped the clipboard for crypto seeds an...
Read Briefing
Threat Research
Malicious VS Code and Open VSX extensions are now embedding fake system instructions and context floods aimed directly at the AI-powered ...
Read Briefing
Malware Analysis
A retro-hunt across Argus scan history tied the ShopifySTORES Replit MSI dropper and the State Diagram STDX dropper to the same builder k...
Read Briefing
Malware Analysis
Argus caught a variation of the GLASSWORM campaign and flagged seven malicious extension names. We uncover what the TinyGo-compiled WebAs...
Read Briefing
Threat Intel
A notebook productivity tool turns into a full remote access implant whose architecture overlaps with two documented DPRK campaigns — Con...
Read Briefing
Malware Analysis
A new wave on Open VSX, a two-tier Solana dead-drop, and a Go-based backdoor.
Read Briefing
Security Research
Yeeth Security has been added to the Open VSX Security Hall of Fame as a security guardian. A look at the work that led here, and what it...
Read Briefing
Security Research
What developer-environment threats look like in 2026, and the controls security leaders should put in place. Written by Yeeth Security fr...
Read Briefing
Threat Intel
Sixteen extensions in 48 hours. All share one author. A forensic walkthrough of how Bane, Yeeth Security's threat-intelligence knowledge ...
Read Briefing
Threat Intel
A campaign of VS Code extensions using GitHub releases as a payload delivery mechanism — and blockchain RPCs as command-and-control
Read Briefing
Threat Intel
Analyzing a Massive 174-Account Surge on Open VSX
Read Briefing
Threat Intel
Dissecting a Downloader Abusing Extension Packs for Stealthy Distribution
Read Briefing
Year in Review
A look back at what we did and where we are going.
Read Briefing
Security Research
Why scalable secret detection is a systems problem that matters
Read Briefing
Malware Analysis
Dissecting an Obfuscated Downloader with Anti-analysis Guardrails
Read Briefing
Malware Analysis
Technical analysis a new iteration of SleepyDuck, a tiny loader that behaves like a backdoor.
Read Briefing
Malware Analysis
Technical analysis of one of the early WhiteCobra samples in the wild.
Read Briefing