GoKawiil77 extensions on the Open VSX marketplace impersonated legitimate developer tools while transmitting information about the systems and development environments where they were installed.
The so-called "evil twin" campaign was discovered by Manifold Security, which detected the extensions between July 26 and August 1, 2026. Researchers linked all 77 extensions to the same activity through a shared data-exfiltration domain, as well as code and network behavior.
While 58 extensions sent only a small amount of system information, the remaining 19 contained more extensive reconnaissance that exfiltrated developer, Git repository, and continuous integration (CI) metadata.
However, Manifold found that the extensions did not access source code, credentials, authentication tokens, SSH material, or browser data, and declined to speculate on the campaign's purpose.
Evil Twin extensions linked through shared infrastructure
An "evil twin" extension is a counterfeit package that copies the identity of a legitimate extension to trick people into installing it.
In this campaign, the packages reused the names, namespaces, and descriptions of real Open VSX extensions but were published through unrelated accounts.
Most were assigned the low version number 0.0.1, while the legitimate extension's bundled extension.js file was replaced with code designed primarily to collect and transmit data.
Manifold says the extensions did not provide the functionality advertised in their listings and instead displayed a status bar indicator or message saying the extension was active before transmitting data to the attacker's server.
The packages impersonated extensions associated with a wide range of technologies and organizations, including AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA, and a U.S. government agency namespace.
... continue reading