Cybersecurity firm **Manifold Security** recently identified a widespread 'evil twin' campaign on the **Open VSX marketplace**, involving 77 malicious extensions that impersonated legitimate developer tools. Detected between July 26 and August 1, 2026, these extensions were found to be transmitting system and development environment data to attacker-controlled infrastructure. All 77 extensions were linked through a shared data exfiltration domain, `mangorbit[.]com`, and exhibited consistent code and network behaviors. While 58 of these extensions primarily collected basic system information, a more concerning subset of 19 contained extensive reconnaissance capabilities, exfiltrating developer, Git repository, and continuous integration (CI) metadata.  ### The Anatomy of an Evil Twin An "evil twin" extension is a deceptive package that meticulously copies the identity of a genuine extension to trick users into installing it. In this campaign, the attackers reused the names, namespaces, and descriptions of real **Open VSX** extensions, but published them through unrelated accounts. Most of these malicious packages were assigned a low version number (0.0.1). The legitimate `extension.js` file was replaced with code specifically designed for data collection and transmission, rather than providing the advertised functionality. Users would typically see only a status bar indicator or a message stating the extension was active before data exfiltration began. These counterfeit packages impersonated extensions associated with a diverse range of technologies and organizations, including **AMD**, **Azure**, **Salesforce**, **Hyperledger**, **LEGO Education**, **IOTA**, and even a U.S. government agency namespace.  ### Shared Infrastructure and Data Exfiltration All 77 malicious extensions communicated with a server at `mangorbit[.]com`, a domain registered just eleven days before the first packages appeared. Most samples contacted `pulse.mangorbit[.]com` or `pulse2.mangorbit[.]com`, with others using `api.mangorbit[.]com` or randomized subdomains under `cb.mangorbit[.]com`. Each package included a unique tracking identifier, allowing the operators to monitor installations. Fifty-eight of the extensions exfiltrated the machine's hostname, with some also sending the workspace folder name and editor version. The more aggressive 19 extensions collected a significantly broader array of information within seconds of activation, including: * Operating system username and hostname * Machine identifier * Editor name and version * Platform architecture, locale, and timezone * Name and full filesystem path of the open workspace Additionally, these extensions inspected files within the workspace's `.git` directory to harvest Git remote hosts and organizations, the domain of the developer's configured email, the current branch, and the **HEAD** commit hash. They also enumerated up to 60 installed extensions and collected identifiers from various CI and cloud development environments, such as **GitHub**, **GitLab**, **Azure DevOps**, **Buildkite**, **CircleCI**, **GitHub Codespaces**, and **Gitpod**.  ### Deceptive Disclosures and Persistent Exfiltration Intriguingly, the **Open VSX** listings for these malicious extensions claimed to collect "anonymous usage metrics" and accurately stated they did not access source code or credentials. However, **Manifold Security** found that the extensions sent more data than disclosed, including CI information that could expose private repository names or paths. Some variants even checked whether they were installed manually or via project configuration. Certain versions were designed for persistence, attempting to transmit collected data for up to seven days. They also supported multiple collection endpoints and could query a **DNS TXT** record for a replacement URL if the hardcoded infrastructure became unresponsive. While **Manifold Security** has not attributed the campaign or speculated on the operator's intent, the extensive metadata collected by the 19 reconnaissance extensions is sufficient to profile organizations, development environments, and private repositories. ### Remediation and Recommendations The malicious packages were removed from **Open VSX** by August 3, 2026. However, developers must manually remove these extensions from their systems and applications. **Manifold Security** advises checking systems and workspace configuration files for the extension IDs listed in their report and blocking the `mangorbit[.]com` domain to prevent further communication with the attacker's infrastructure.