Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
Extension Confusion Lets Attackers Hijack Trusted Names Across VS Code Registries
Excerpt
A coordinated campaign used 77 counterfeit VS Code extensions to collect developer and CI environment data through Open VSX. The packages copied trusted extension names, namespaces, and descriptions, but were published from unrelated pseudonymous accounts. Between July 26 and August 1, 2026, all 77 extensions contacted the same newly registered domain, mangorbit[.]com. Most used version 0.0.1 and replaced the legitimate extension’s extension.js with a beaconing component.…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | mangorbit.com | Medium | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…