Visual Studio Extensions Revisited

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://mdsec.co.uk/2026/05/visual-studio-extensions-revisited
• Blog Title: Visual Studio Extensions Revisited
• Suggested Section: Generic Hacking → Software Supply-Chain and IDE/Developer Extension Abuse (new subsection)

🎯 Content Summary

Scope, severity, and security model. MDSec’s post, dated 28 May 2026, revisits Visual Studio extensions as an initial-access and software-supply-chain mechanism. It follows earlier research into VS Code extension abuse and references GitHub’s report of unauthorized access involving a compromised VS Code extension. The Visual Studio technique is not a named CVE or memory-corruption vuln...

🔧 Technical Details

Editor-event execution: A malicious VisualStudio.Extensibility extension can implement ITextViewOpenClosedListener and place code in TextViewOpenedAsync. By applying DocumentFilter.FromDocumentType("json") or another common document filter, the extension executes automatically when the user opens a matching file. A legitimate feature such as JSON formatting can conceal the malicious action. The same approach can be adapted to text-change listeners or other editor events.

In-memory remote assembly staging: The extension can call an HTTP endpoint, read a Base64 response, decode it with Convert.FromBase64String, create a collectible AssemblyLoadContext using a generated name and true for collectibility, load the bytes with LoadFromStream, locate EntryPoint through reflection, invoke it with an optional string[]🤖 Agent Actions

Plan:

1. Map the repository and inspect at least five relevant pages.
2. Compare existing IDE/supply-chain coverage with the supplied research.
3. Add only non-duplicative techniques to the best existing page (or create/link one only if necessary).
4. Validate citations, Markdown structure, links, and the final diff.
   Repository review points to the existing editor-plugin abuse page as the closest fit. I’m broadening that page rather than creating a redundant generic-hacking page, and I’ll keep the Visual Studio material explicitly separated from privilege escalation.
   Implemented the HackTricks update.

Changes

• Expanded the existing editor-plugin page into Editor Extension and Plugin Abuse for Execution and Supply-Chain Access.
• Added:
  • Visual Studio editor-event execution via ITextViewOpenClosedListener
  • In-memory AssemblyLoadContext.LoadFromStream staging
  • VSIX marketplace/publisher abuse
  • Static VSIX auditing with ilspycmd
  • Technical hunting indicators
  • Clarification that AllUsers installation is not privilege escalation
• Added numbered citations to MDSec and Microsoft documentation.
• Updated src/SUMMARY.md navigation.

Validation

• git diff --check passed.
• Markdown fences, <details> blocks, citations, references, banner, and SUMMARY path validated.
• All reference URLs returned HTTP 200.
• Forbidden sources were not used.
• mdbook was unavailable, so a full build could not be run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://mdsec.co.uk/2026/05/visual-studio-extensions-revisited

Content Categories: Based on the analysis, this content was categorized under "Generic Hacking → Software Supply-Chain and IDE/Developer Extension Abuse (new subsection)".

Repository Maintenance:

• MD Files Formatting: 1031 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0