Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Malicious VSCode Extension Launches Multi-Stage Attack Chain with Anivia Loader and OctoRAT

hunt.io | blog | #supply-chain | #attack-chains | #malware | #vscode | #rat | #octorat | #anivia | #malicious-extension

Summary

A fake 'prettier-vscode-plus' extension on the official VSCode Marketplace delivered the Anivia loader and OctoRAT—a RAT with 70+ commands—in a supply-chain attack that rotated payloads.
Published
Collected

original ↗

Related coverage

blog · aikido.dev
Novel supplychain.local Go worm appears
On 23 September 2026, a threat actor published a novel supply chain worm to the following packages:
blog · aikido.dev
Graphalgo campaign spreads to Terraform providers and Go Modules
Go malware has appeared in two Terraform providers and two Go modules — the first observed abuse of Terraform providers. The Graphalgo Go port hides a hash-gated trigger with blockchain and Slack C2.
blog · wiz.io
The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave
Wiz attributes the cross-ecosystem campaign to TeamPCP: @antv npm packages, actions-cool/issues-helper GitHub Action, and a VS Code extension steal credentials and drop a GitHub-polled backdoor.
blog · hunt.io
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files
Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.
blog · hunt.io
Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries
An exposed open directory reveals an operator staging NGINX Rift, Ghost CMS, and other recent CVEs against government and finance, using DNS callbacks to verify execution.
blog · hunt.io
Exposed BYOB C2 Infrastructure Reveals a Multi-Stage Malware Deployment
A live BYOB C2 open directory revealed a multi-stage deployment: droppers, stagers and post-exploitation modules for Windows, Linux and macOS, seven persistence mechanisms, plus XMRig miners.
back