Case whitecobra-vsix-crypto-stealersAI supply chainWorldwide
WhiteCobra floods Open VSX and VS Code Marketplace with 24 crypto-stealing extensions
Koi Security tied a crew it named WhiteCobra to 24 malicious extensions whose second-stage script fetched LummaStealer or a macOS payload; Ethereum developer Zak Cole lost his wallet to a fake Solidity extension for Cursor.
HighAttack on AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 13, 2025
- Location
- Worldwide
- Target
- VS Code, Cursor and Windsurf users
- Severity
- High
- Triggered by
- WhiteCobra
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Koi Security tied a crew it named WhiteCobra to 24 malicious extensions whose second-stage script fetched LummaStealer or a macOS payload; Ethereum developer Zak Cole lost his wallet to a fake Solidity extension for Cursor.
Impact: 24 extensions targeting VS Code, Cursor and Windsurf users; at least two confirmed wallet thefts including one of about 500,000 dollars; infostealer theft of credentials and messaging data
Who triggered it
Actor: WhiteCobra
Attribution: Named by Koi Security from a leaked playbook; linked to the July 2025 Cursor extension theft of about 500,000 dollars
Motive: Cryptocurrency theft with campaign revenue targets of 10,000 to 500,000 dollars
How it happened
Attack vector: Lookalike extensions on Open VSX (16) and the Visual Studio Marketplace (8) with inflated downloads; prompt.js downloads platform-specific payloads from Cloudflare Pages
Root cause: Shared VSIX ecosystem lets malicious extensions reach AI editors through Open VSX with minimal review; new versions replace removed ones within hours
Timeline
- Fake Solidity extension leads to a 500,000 dollar theft investigated by Kaspersky
- Zak Cole reports his wallet drained after installing a fake Solidity extension with 54,000 Open VSX downloads
- Koi Security publishes the WhiteCobra analysis; campaign still active
Response
Marketplaces removed reported extensions but the actor kept republishing; Koi advised scrutinising new extensions with sudden download spikes
Current status: Ongoing
Sources (open in a new tab)
- BleepingComputer bleepingcomputer.com
- Kaspersky kaspersky.com
Cite this case
WhiteCobra floods Open VSX and VS Code Marketplace with 24 crypto-stealing extensions. AI Threat Watch, case whitecobra-vsix-crypto-stealers, Sep 13, 2025. https://aithreat.io/cases/whitecobra-vsix-crypto-stealers/
Permanent link: https://aithreat.io/cases/whitecobra-vsix-crypto-stealers/