Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A loophole in VS Code Marketplace allows malicious actors to reuse names of removed extensions. ReversingLabs discovered this vulnerability after finding a malicious extension with the same name as one previously identified. The platform's documentation states that extension names must be unique, but removed extensions' names can be reused. This poses a risk of threat actors publishing malicious extensions under previously legitimate names. The research team conducted experiments to confirm this vulnerability, successfully publishing extensions with names of removed packages. This technique has been observed in other open-source platforms like PyPI. The discovery highlights the increasing popularity of VS Code Marketplace among malicious actors and the need for developers to be vigilant about package security.

The identified security threat concerns a loophole in the Visual Studio Code (VS Code) Marketplace that allows malicious actors to claim and publish extensions using the names of previously removed legitimate extensions. Although the VS Code Marketplace enforces uniqueness of extension names at the time of publication, it does not prevent reuse of names once an extension is removed. This vulnerability was discovered by ReversingLabs after they found a malicious extension published under the same name as a previously identified legitimate extension. The research team validated this loophole by successfully publishing extensions with names of removed packages, demonstrating that threat actors can exploit this to deceive users into installing malicious extensions that appear trustworthy due to their familiar names. This attack vector is similar to known techniques used in other open-source package repositories such as PyPI, where attackers reuse names of removed or abandoned packages to distribute malware or conduct supply chain attacks. The threat leverages social engineering and software supply chain compromise tactics (MITRE ATT&CK techniques T1195, T1204, T1059 variants) to trick developers into installing malicious code, potentially leading to execution of arbitrary code, credential theft, or further network compromise. While no active exploits have been reported in the wild yet, the increasing popularity of VS Code Marketplace makes it an attractive target for attackers. The lack of a patch or direct fix from the platform means that vigilance and proactive security measures by developers and organizations are critical to mitigate risk. The hashes of known malicious extensions related to this campaign have been shared for detection purposes.

Detailed information about Loophole allows threat actors to claim VS Code extension names. Get real-time updates, technical details, and mitigation strategies.

Loophole allows threat actors to claim VS Code extension names - Live Threat Intelligence - Threat Radar | OffSeq.com

Loophole allows threat actors to claim VS Code extension names

Threats Tagged 'loophole'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'loophole'

Lead Pen Test Professional