The recent Evelyn Stealer malware campaign has emerged as a significant threat to software developers, employing malicious Visual Studio Code extensions to infiltrate systems. The attack targets development teams, leveraging their access to production systems and cloud resources to exfiltrate sensitive data such as developer credentials, cryptocurrency wallets, browser cookies, clipboard content, and Wi-Fi credentials.
Evelyn Stealer employs a sophisticated arsenal of techniques to evade detection and analysis. The malware uses process injection, anti-analysis checks, and headless browser manipulation, enabling it to operate stealthily. Additionally, the campaign exhibits operational maturity, employing DLL sideloading, process hollowing with AES-256-CBC encryption, and advanced anti-analysis methods like VM detection and debugger evasion.
A notable feature of this malware is its ability to harvest browser credentials through DLL injection, capture screenshots, and exfiltrate data using protocols like FTP. Moreover, it manipulates browser execution by running in a headless mode with disabled security measures, further enhancing its ability to steal sensitive data undetected.
The campaign’s sophistication is highlighted by detailed filename tracking and comprehensive system reconnaissance, demonstrating a high level of planning and execution. This makes developers and their privileged access to organizational systems particularly enticing targets for malicious actors.
Additionally, the discovery of two other Python-based stealer families, MonetaStealer and SolyxImmortal, reflects a growing trend of similar threats targeting developers, indicating an escalating focus on exploiting their critical roles within organizations.

Collections

Evelyn Stealer is a sophisticated malware campaign targeting software developers through malicious VS Code extensions. It steals credentials, cryptocurrency wallets, browser data, and Wi-Fi information using advanced evasion techniques including process injection, DLL sideloading, AES-256-CBC encryption, VM detection, and headless browser manipulation. The campaign demonstrates high operational maturity with detailed system reconnaissance and filename tracking. Two additional Python-based stealer families (MonetaStealer and SolyxImmortal) have also been discovered, indicating a growing trend of attacks specifically targeting developers and their privileged access to organizational systems.

Evelyn Stealer Malware Exploits VS Code Extensions to Target Developers and Steal Credentials