Executive Summary
In October 2026, the SleepyDuck malware campaign transitioned from the Open VSX registry to the Microsoft VS Code Marketplace. The actor uses sophisticated evasion techniques, including a 'version shuffle' where malicious builds are briefly served before being reverted to clean decoys, and zero-width characters in display names to impersonate legitimate developers like Juan Blanco.
The attack chain involves weaponized VS Code extensions that deploy a steganographic MP4 carrier (The Duck Song.mp4). This carrier contains the 'evjawbreaker' Go implant and a genuine, though unsigned, ConnectWise ScreenConnect installer. Recent iterations of the campaign have further evolved to include nested extension installations and runtime fetching of malicious payloads from external file hosts like catbox.moe to minimize the footprint of the initial marketplace package.
This campaign represents a significant risk to developers and Web3 organizations. The actor's use of UAC bypasses (specifically the .NET Profiler method) and anti-analysis gates targeted at debuggers and virtual machines demonstrates high technical proficiency. The primary objective appears to be establishing persistent remote access and monitoring of developer environments.