Back to today’s briefing

Story perspectives

Microsoft's Marketplace Flaw: Dangerous Extensions Enable Ransomware

3/21/2025

45 7

Summary

Story summary

ReversingLabs has uncovered two dangerous extensions, shiba and cychelloworld, lurking in the Visual Studio Code marketplace, slipping past Microsoft's security measures. Though downloaded only a handful of times, they unleashed a PowerShell script capable of launching a ransomware attack, encrypting files in a test directory. Their removal underscores critical flaws in Microsoft's defenses.

1 of 1

Story summary

ReversingLabs has uncovered two dangerous extensions, shiba and cychelloworld, lurking in the Visual Studio Code marketplace, slipping past Microsoft's security measures. Though downloaded only a handful of times, they unleashed a PowerShell script capable of launching a ransomware attack, encrypting files in a test directory. Their removal underscores critical flaws in Microsoft's defenses.