IDE Extensions
Subtechnique · ATTACK:enterprise:T1176.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1176.002",
"title": "IDE Extensions",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1176/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--66b34be7-6915-4b83-8d5a-b0f0592b5e41",
"external_id": "T1176.002",
"domain": "enterprise",
"created": "2025-03-30T22:16:24.078Z",
"modified": "2025-04-23T12:40:46.664Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"persistence"
],
"source_references": [
{
"source_name": "Abramovsky VSCode Security",
"url": "https://blog.checkpoint.com/securing-the-cloud/malicious-vscode-extensions-with-more-than-45k-downloads-steal-pii-and-enable-backdoors/"
},
{
"source_name": "Lakshmanan Visual Studio Marketplace",
"url": "https://thehackernews.com/2023/01/hackers-distributing-malicious-visual.html"
},
{
"source_name": "Mnemonic misuse visual studio",
"url": "https://www.mnemonic.io/resources/blog/misuse-of-visual-studio-code-for-traffic-tunnelling/"
},
{
"source_name": "ExtensionTotal VSCode Extensions 2025",
"url": "https://blog.extensiontotal.com/mining-in-plain-sight-the-vs-code-extension-cryptojacking-campaign-19ca12904b59"
}
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1176.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16a6739b-93e9-49ea-ae74-624623d3c07a
ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1176.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19913bf1-7180-4105-8d31-c645ed901d35
ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1176.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--642bdc02-70d1-4916-8cd8-e69ed7979e9e
Unit42 Chinese VSCode 06 September 2024ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1176.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72743007-3292-4f1a-9d68-88d39f145ea6
ATTACK:enterprise:M1033 → mitigates → ATTACK:enterprise:T1176.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9de9222b-65c4-4f04-800c-ab667f53901b
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1176.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a591d4cc-d03b-45f6-833f-3831dfaf9bbe
ATTACK:enterprise:T1176.002 → subtechnique-of → ATTACK:enterprise:T1176
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e87763bc-3873-4fc4-afa6-7d4aed8d839f
ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1176.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4b6ec8f-fa03-4584-929b-649ef3e999b1
Aikido TeamPCP Telnyx MAR 2026 · Flashpoint Mini Shai-Hulud MAY 2026 · Wiz TeamPCP KICS MAR 2026 · Trend Micro TeamPCP MAY 2026 · Phoenix TeamPCP 20 MAY 2026