VS Code Extension Impersonating Zoom Targets Google Chrome Cookies

On 23 September 2026, a threat actor published a novel supply chain worm to the following packages:

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

ClickFix hijacks live Facebook sessions via fake verification and appeal flows aimed at creators: 115 pages, eight serverless exfiltration endpoints, and 103 related hostnames found by title pivot.

Hunt.io uses SSL history to tie a certificate to the Cyberhaven extension compromise, connecting its C2 servers to a wider campaign against Facebook ad accounts via fast-rotating Let's Encrypt certs.

Hunt.io exposes a multi-stage campaign: a scheduled-task executable and 'Dark Mode' Chrome extensions built from open-source spying code, plus a decoy Cobalt Strike PDF pushing duplicates.

This post describes a sophisticated social engineering campaign using Zoom's remote control feature and provides technical solutions to protect organizations against this attack vector.