GCVE-110-OSM-2026-10374

ManageRBLX v4.9.5, published by GeorgeXBT (unverified) on the VS Code Marketplace, is a fake Roblox management extension with no legitimate functionality. It auto-executes on VS Code startup via activationEvents ["*"], running a JavaScript -> VBS -> Batch -> PowerShell payload chain that establishes persistence, evades detection, and injects into a remote process. Malicious payload found in: extension/src/extension.js Extension SHA-256: cfdf72c510670341dce392ab250a5f5ff2a398d993d1106fb8026ec6397cb393 === STAGE 1: Runtime Trigger === activationEvents: ["*"] forces execution on every VS Code startup. Process chain: code.exe -> cscript.exe //nologo //e:jscript %TEMP%\nice.js === STAGE 2: JS Loader (newly.js) === Downloaded from: https://giantapplebees.shop/newly.js SHA-256: 4bb573dc1b0044bd45f4d06eec6930d16ba14ec13a078e666a0f8f6af845879b Staged to: %TEMP%\nice.js === STAGE 3: VBS Launcher (gay.vbs) === Downloaded from: https://giantapplebees.shop/gay.vbs SHA-256: a87340cfc16a7ea2fa8337f4b37c0a3c6faca056fecf37b505b56f0dd2f595ac Staged to: %TEMP%\svchost.vbs === STAGE 4: Batch Crypter (sellmysoul.bat) === Downloaded from: https://giantapplebees.shop/sellmysoul.bat SHA-256: 25cabbfa2526fdd9f8cc535bd468f176fc958754f6ff9a837f51bf4168b97855 Staged to: %TEMP%\gay1.bat Decodes a decoy icon.png (SHA-256: 380d5c8d2e56298bf66b55240c29ce70984276aa71e0f2c3cb30525dd3bfb9eb) via dual-blob carving (:: and @ line delimiters) to separate cover image from malicious payload. === STAGE 5: Final PowerShell Loader === SHA-256: d9aef6529ace1b8d1bac85a55b232bfd7a362015ecb1e160ad0006c23b862214 Encoding: base64 + XOR (key "qc" / 0x71 0x63) -> IEX Renamed powershell.exe dropped to: %USERPROFILE%\Downloads\svchost.exe Persistence: hidden+system directory C:\ProgramData\IntelDriver\, scheduled task via schtasks /create Anti-analysis: exits if Administrator detected; VM detection (RAM < 3GB); ETW patching Defense evasion: process injection via VirtualAlloc + WriteProcessMemory + CreateRemoteThread