DPRK-Linked Backdoor Discovered in VS Code Marketplace

On June 8, 2026, researchers unmasked a series of malicious VS Code extensions—including jupyter-powerdev, jupyter-powertools, and markdown-mode-devtools—that bypass Microsoft marketplace reviews to establish a sophisticated backdoor. The campaign is attributed to suspected North Korean (DPRK) state-sponsored actors, specifically mirroring architectural patterns used by Lazarus Group (Famous Chollima) in previous campaigns like Contagious Interview and DreamLoader.

The attack chain involves a JavaScript extension layer that communicates with Azure-hosted auth brokers to obtain Microsoft Graph API tokens. These tokens are used to interact with SharePoint lists acting as command queues and exfiltration channels. On Windows, the malware reflectively loads a .NET binary using Costura.Fody and the Roslyn scripting API for arbitrary in-memory C# execution, while Linux and macOS systems are targeted with a Python-based agent.

This campaign represents a critical evolution in supply chain persistence, targeting developer environments directly through legitimate marketplace infrastructure. The use of Microsoft-owned infrastructure for C2 (Graph API and SharePoint) makes the malicious traffic indistinguishable from legitimate enterprise activity, necessitating deep monitoring of IDE extension behaviors and Graph API audit logs.