Full Report
77 extensions on the Open VSX marketplace impersonated legitimate developer tools while transmitting information about the systems and development environments where they were installed. [...]
Analysis Summary
# Incident Report: Open VSX "Evil Twin" Extension Campaign
## Executive Summary
Between July and August 2026, 77 malicious extensions were discovered on the Open VSX marketplace impersonating legitimate developer tools. These "evil twin" extensions were designed to harvest system metadata, Git repository information, and CI/CD environment details from developers. While the extensions did not exfiltrate source code or credentials, they provided the attackers with extensive reconnaissance data for 19 specific high-value targets.
## Incident Details
- **Discovery Date:** July 26, 2026 – August 1, 2026
- **Incident Date:** July 15, 2026 (Infrastructure setup) – August 3, 2026 (Removal)
- **Affected Organization:** Users of Open VSX Marketplace (impersonated brands include AMD, Azure, Salesforce, etc.)
- **Sector:** Software Development / Technology
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** July 26, 2026
- **Vector:** Supply Chain Attack (Typosquatting/Masquerading)
- **Details:** Attackers published 77 extensions using the names, namespaces, and descriptions of legitimate tools but under unrelated accounts.
### Lateral Movement
- **Details:** N/A. The attack focused on reconnaissance and data exfiltration from the local development environment rather than moving through a corporate network.
### Data Exfiltration/Impact
- **Details:** 58 extensions exfiltrated hostnames and editor versions. 19 "reconnaissance" extensions exfiltrated OS usernames, machine IDs, full filesystem paths, Git remote hosts, developer email domains, branch names, and CI environment identifiers (GitHub, GitLab, CircleCI, etc.).
### Detection & Response
- **Discovery:** Detected by Manifold Security through behavioral analysis and shared exfiltration infrastructure.
- **Response Actions:** Open VSX removed the malicious packages by August 3, 2026.
## Attack Methodology
- **Initial Access:** Evil Twin extensions (Counterfeit packages).
- **Persistence:** Some variants included retry logic for up to seven days; supported multiple collection endpoints.
- **Privilege Escalation:** N/A.
- **Defense Evasion:** Used low version numbers (0.0.1); claimed to collect "anonymous usage metrics" in listings to appear transparent; used DNS TXT records to update C2 URLs if hardcoded ones were blocked.
- **Credential Access:** None detected (explicitly avoided source code and credentials).
- **Discovery:** Enumerated up to 60 installed extensions; identified CI/CD and cloud dev environments.
- **Lateral Movement:** N/A.
- **Collection:** Scraped `.git` directories and system environment variables.
- **Exfiltration:** HTTPS POST requests to attacker-controlled subdomains.
- **Impact:** Information disclosure and organizational profiling.
## Impact Assessment
- **Financial:** No direct theft reported; costs involve remediation and investigation time.
- **Data Breach:** Metadata regarding private repository structures, developer identities, and internal paths.
- **Operational:** Minimal disruption to developer workflows, but requires manual cleanup of infected machines.
- **Reputational:** High impact for the Open VSX marketplace; moderate for impersonated brands.
## Indicators of Compromise
- **Network indicators:**
- mangorbit[.]com
- pulse.mangorbit[.]com
- pulse2.mangorbit[.]com
- api.mangorbit[.]com
- cb.mangorbit[.]com (and randomized subdomains)
- **File indicators:**
- `extension.js` (malicious versions found in 0.0.1 packages)
- **Behavioral indicators:**
- Extensions displaying a status bar message "extension is active" without providing advertised functionality.
- DNS TXT record queries to the primary domain for C2 updates.
## Response Actions
- **Containment:** Removal of all 77 identified extensions from the Open VSX Marketplace.
- **Eradication:** Blocking of the `mangorbit[.]com` domain at the network level.
- **Recovery:** Developers advised to manually uninstall the specific extension IDs and check workspace configuration files.
## Lessons Learned
- **Supply Chain Vulnerability:** Even alternative marketplaces like Open VSX are targets for sophisticated masquerading campaigns.
- **"Semi-Transparent" Maliciousness:** Attackers are now disclosing some data collection in descriptions to bypass basic scrutiny, while actually harvesting more than stated.
- **Reconnaissance Focus:** The lack of credential theft suggests this may have been a "stage one" operation to identify high-value targets for future, more targeted attacks.
## Recommendations
- **Verification:** Implement a "Verified Publisher" badge or stricter namespace ownership controls on the marketplace.
- **Endpoint Monitoring:** Use EDR/DLP tools to monitor development environments for unusual outbound traffic from IDE extensions.
- **Policy:** Establish an organizational "allow-list" for IDE extensions or require security reviews before installation in production environments.