Fake Google Update Extension Turns VS Code Into a Malware Delivery Tool

This story was originally published on HackerNoon at: https://hackernoon.com/fake-google-update-extension-turns-vs-code-into-a-malware-delivery-tool. How a fake Google Update Support extension installs its components and runs the editor's own Electron binary as a Node interpreter. Check more stories related to cybersecurity at: https://hackernoon.com/c/cybersecurity. You can also check exclusive content about #cybersecurity, #malware, #vscode, #electron, #threat-intelligence, #developer-security, #social-engineering, #javascript, and more. This story was written by: @ilja-krasnjanski. Learn more about this writer by checking @ilja-krasnjanski's about page, and for more stories, please visit hackernoon.com. A take-home repository from a fake job interview starts a VS Code task when the folder is opened, installing an extension called Google Update Support. The 17.6 MB package carries native agents for macOS and Linux, encrypted Windows components, and a path that runs the signed editor binary as a plain Node interpreter. Reconstructed from the artifacts without running any sample.