VS Code and Browser Extension Malware Targets Developers Through AI Tools and Stanley Kit

Du'aine Davis

Observed in the wild

• MaliciousCorgi, a campaign discovered in January 2025, deployed malicious VS Code extensions disguised as AI coding assistants (including "ChatGPT – 中文版" and "ChatMoss (CodeMoss)") that infected approximately 1.5 million developers globally. Separately, the Stanley malware kit has been active since 2023, targeting developers through trojanised extensions. Both campaigns exfiltrated sensitive data including authentication tokens, cookies, session credentials, clipboard contents, and source code from platforms like GitHub, GitLab, and AWS.
• MaliciousCorgi extensions masqueraded as legitimate AI productivity tools on Chrome Web Store and Edge Add-ons, using obfuscated JavaScript to steal credentials and inject malicious code into GitHub repositories for supply chain attacks. Stanley operators employed phishing sites mimicking legitimate services, SEO poisoning, and malvertising to distribute extensions that captured keystrokes, screenshots, and credential data. Both campaigns utilised command-and-control infrastructure to exfiltrate stolen data to attacker-controlled servers.
• Organisations should audit, restrict, and continuously monitor both VS Code extensions and browser extensions, as each represents a viable attack surface. Particular attention should be paid to AI‑themed coding tools and productivity add‑ons across both platforms. Enable Microsoft Defender browser extension controls and SmartScreen filtering to limit exposure to malicious or untrusted extensions. Enforce application control policies to prevent unauthorised extension installation in development environments and browsers alike. Monitor for anomalous authentication behaviour, unauthorised repository access, and data exfiltration attempts.

Malicious VS Code AI Extensions Harvesting Code from 1.5M Devs

Stanley — A $6,000 Russian Malware Toolkit with Chrome Web Store Guarantee

Du'aine Davis

Malicious “AI Assistant” Extensions Target 260k Chrome Users

Observed in the wild

• In a coordinated campaign disclosed in February, over 30 malicious Chrome extensions masquerading as AI assistants impacted 260,000+ users. Some were even Featured in the Chrome Web Store, increasing trust and adoption. Enterprise users were particularly exposed due to access to authenticated internal and Gmail content.
• A single threat actor used extension spraying and remote iframe injection, embedding full‑screen iframes controlled by attacker servers (tapnetic[.]pro). Core logic executed remotely, enabling silent capability changes post‑installation. Extensions extracted web page and Gmail content, enabled voice capture, and exfiltrated data via consistent C2 infrastructure, evading store‑based review and takedowns.
• Organisations are advised to audit and restrict browser extensions via policy, prioritising those loading remote iframes or mutable backends. Using Microsoft Defender for Endpoint, monitor suspicious extension network traffic, DOM injection into Gmail, and anomalous data exfiltration.

“AiFrame”- Fake AI Assistant Extensions Targeting 260,000 Chrome Users via injected iframes - LayerX