Debjeet Banerjee
I am Debjeet, a Malware Developer for Black Hills Information Security. I curate malware and tools for testers, publishes research, discovers new bypasses and creates automation pipelines. Previously, he used to work as a Consultant with Certus and a Researcher with Payatu. When I am not in front of the computer, I am either reading Philosophy books, playing Dark Souls or riding bikes!
Session
Visual Studio Code has become the de-facto IDE for millions of developers, and its extension marketplace is now a first-class target for supply-chain compromise. In this talk we move beyond yesterday’s JavaScript-only “theme” backdoors and show how to fuse high-level TypeScript with low-level Rust to create extensions that are indistinguishable from legitimate Microsoft-signed add-ons—yet silently execute native x86_64 shellcode inside the IDE process.
We begin with a data-driven tour of recent in-the-wild incidents: we begin by examining an array of malicious solidity extensions which targeted blockchain developers with a special emphasis on the “Solidity” extension that stole $500 k in crypto from a Russian blockchain developer. We follow that up with an analysis of the Malicious Corgi malware, and the new self propagating GlassWorm extension - including the later samples seen in the wild which used more advanced techniques. The rise of AI-centric forks (Cursor, Windsurf, etc.) has also given a rise to new extension marketplaces where malicious extension can use inflated download counts to serve as perfect camouflage. Next we deep-dive into the malicious extension toolchain: a Rust FFI bridge that compiles to a library, exposes a single innocent-looking TypeScript API, and preserves the marketplace’s blue “verified” tick. We demonstrate live how to backdoor legit extensions - including cases where the source code is available and when it is not.
We close with defensive takeaways: IoCs and TTPs to look for, defensive rules which can prevent such attacks and possible detection vectors. Attendees leave with a fully annotated GitHub repo that walks them through the process of developing such malware - starting with a "hello-world" C++ addon and building a rust based shellcode loader backdoored into a popular extensions.