Malicious AI-made extension with ransomware capabilities sneaks on to Microsoft's official VS Code marketplace - so devs beware

Ransomware.

• Malicious VS Code extension ‘susvsex’ acted as ransomware and used GitHub for command control
• Extension appeared AI-generated, with embedded decryption keys and suspicious metadata
• Microsoft removed it after public pressure, raising concerns about marketplace review gaps

A malicious extension was published on Microsoft’s official VS Code marketplace, and was able to remain there for some time gathering downloads and infecting people’s computers.