Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

Summary

77 malicious extensions impersonating developer tools were found on Open VSX, exfiltrating system and development environment data. These 'evil twin' extensions, active between July 26 and August 1, 2026, have been removed. Some exfiltrated basic hostname data, while others sent detailed system information, repository details, and CI system configurations to 'mangorbit[.]com'.

Key Takeaways

1. A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed.
2. The "evil twin" extensions were uploaded to the repository between July 26 and August 1, 2026, according to Manifold Security.
3. In nineteen of them it sends a detailed description of the machine, the repository open in the editor, and the CI system the editor is running inside.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents factual information about a security incident, citing specific details and researchers. It avoids sensationalism and focuses on technical aspects. The information is verifiable through security advisories.

Bias assessment: Security Focused Reporting. The article's primary focus is on reporting a security vulnerability and its technical details. It adopts a neutral tone, presenting facts and expert analysis without overt political or ideological leanings.

Note: This article details a security incident involving malicious extensions. Readers should exercise caution and verify extension sources.

Credibility flag: Technical Security Alert

Claimed Facts (10)

• This is a direct statement of fact about the discovery of malicious extensions.
• This states a factual timeline of the malicious extensions' presence, attributed to a security firm.
• This is a factual statement about the action taken by Open VSX.
• This is a direct quote from researchers detailing the extent of data exfiltration.
• This provides a specific number and description of a subset of the malicious extensions.
• This factually details the types of sensitive information exfiltrated by the more advanced malicious extensions.
• This states a factual observation about the commonalities between the malicious extensions.
• This factually describes the technical method used by the malicious extensions.
• This is a factual observation about the discrepancy between advertised and actual functionality.
• This provides factual details about the exfiltration destination and its registration date.

Opinions (6)

• This is a statement of observed behavior presented as a finding, but the interpretation of its purpose is an opinion.
• This is an interpretation of the technical check described in the previous statement, offering an opinion on its meaning.
• This is a speculative statement about the potential use of the collected data, representing an opinion on its significance.
• While attributed to Microsoft, the classification of the payload as a 'self-propagating credential-stealing worm' is an interpretation and thus an opinion statement.
• The description of 'establishing persistence' and 'creating an additional developer-to-developer infection path' are interpretations of the malware's actions, making them opinion statements.
• The assertion that these are 'techniques not documented' is an opinion based on prior reporting.

Claims (5)

• This statement presents a large-scale compromise without immediate, direct attribution to the Open VSX incident, making its connection and scale potentially dubious without further context.
• The claim of resemblance to past activity while simultaneously stating it's unattributed creates a degree of uncertainty and potential for misattribution.
• This is a prescriptive statement about what 'needs' to be done, which is an opinion presented as a requirement without direct evidence of its feasibility or necessity in this specific context.
• This is a strong recommendation presented as a rule that 'should' be implemented, which is a subjective opinion on security policy.
• While the list itself is factual, the implication that these 19 are the *only* ones with detailed exfiltration is not explicitly stated, and the list is presented without further context on their specific impact beyond the general description.

Key Sources

• The Hacker News — News Outlet
• Manifold Security — Security Research Firm
• Ax Sharma — Security Researcher
• Cody Nash — Security Researcher
• Microsoft — Technology Company
• Socket — Security Company
• Moshe Siman Tov Bustan — Security Researcher