Story perspectives

AI-Powered Ransomware Extension Discovered in VS Code Marketplace

11/7/2025

23 5

Summary

Story summary

A malicious Visual Studio Code extension named 'susvsex' with ransomware-like capabilities, apparently created with AI, was uploaded on November 5, 2025.
Secure Annex researcher John Tuckner discovered the extension.
Microsoft removed it from the VS Code Marketplace shortly after.
The extension compresses and encrypts files in specified directories and uses GitHub for command-and-control.
The incident underscores AI-assisted malware risk and the need for developers to verify sources and scrutinize dependencies.

1 of 1

Story summary

A malicious Visual Studio Code extension named 'susvsex' with ransomware-like capabilities, apparently created with AI, was uploaded on November 5, 2025.
Secure Annex researcher John Tuckner discovered the extension.
Microsoft removed it from the VS Code Marketplace shortly after.
The extension compresses and encrypts files in specified directories and uses GitHub for command-and-control.
The incident underscores AI-assisted malware risk and the need for developers to verify sources and scrutinize dependencies.