Hackers Steal GitHub Tokens Through Malicious VS Code Extension That Remained Available for 18 Minutes

A poisoned version of the popular Nx Console extension for Visual Studio Code stayed on the official VS Code Marketplace for only about 18 minutes.

That was long enough for some developers to install it and hand over their secrets. The theft led to one of the most serious developer-tool breaches of 2026.

The extension has more than 2.2 million installs across versions, so even a short window put many machines at risk. The group behind the campaign, TeamPCP, says it took around 3,800 internal repositories from a single GitHub employee’s device.

GitHub called that figure “directionally consistent” with its own investigation. GitHub also said it found no evidence that customer-owned repositories were affected.

Analysts at BlackFog noted the activity in a new report on how TeamPCP turned developer tools into a route for data theft.

The researchers explain that the Nx Console incident was not a one-off. It was the latest step in a campaign that began months earlier with build systems and security tools.

Hackers Steal GitHub Tokens

TeamPCP first appeared at the end of 2025 and is driven by money. Its Telegram channel launched in November 2025 and had close to 700 members by February 2026.

In March 2026, the group got into Aqua Security’s build systems and hid credential-stealing code inside the Trivy vulnerability scanner.

It then used the stolen credentials to hit other tools, including Checkmarx KICS and LiteLLM. Readers can see how this played out when the LiteLLM package was compromised with a backdoor in two versions.

Two months later, on May 18, 2026, the group moved from build pipelines to individual developers. The poisoned Nx Console version reached the marketplace, and it runs directly on a developer’s own computer.

Anything the developer can reach, the malicious code can reach too. That includes source code, cloud keys, and GitHub tokens.

According to BlackFog, the group follows the same pattern each time. It gets into software that already runs, collects every secret within reach, sends the data out, and then uses it.

In the Trivy case, the stealer searched process memory on GitHub-hosted runners for values marked as secrets. On self-hosted runners, it checked more than 50 paths for SSH keys, cloud credentials, and Kubernetes files.

The legitimate scan could keep running, so victims saw nothing odd. Stolen data was locked with AES-256-CBC and an RSA-4096 public key, packed as tpcp.tar.gz, and sent over HTTPS to a lookalike of Aqua’s real domain.

If that upload failed and a strong enough personal access token was available, the payload could create a repository named tpcp-docs in the victim’s own GitHub account and attach the archive to a release.

That fallback is clever because the traffic then appears to come from the victim’s account. Cyber Security News has already covered how the compromised Nx Console extension was pushed using stolen publishing credentials. The Nx team had its own credentials taken during an earlier incident, which made the poisoned release possible.

Why a Short Window Still Causes Long-Term Damage

The 18-minute figure can sound small, but removing a bad package does not remove the access it already gave away. BlackFog says some stolen tokens were used weeks after the first theft.

Credentials taken in March were seen exploring other victim environments later. Stolen GitHub repositories were also listed for sale at a price of at least $50,000.

The group makes money in several ways. It has posted leaked material through ShellForce, offered credentials and source code for sale, and teamed up with ransomware operators such as Vect.

Hijacked servers were also used for cryptomining and proxies. The wider fallout shows up in the Mini Shai-Hulud npm campaign, which pushed npm to reset publishing tokens that bypass two-factor authentication.

Law enforcement has started to respond. In August 2026, Australian authorities charged two alleged principal members, aged 21 and 23.

The US Department of Justice separately announced an indictment against one of them. These allegations remain unproven. Even so, a recent FBI warning about TeamPCP shows how seriously officials take the threat to developer tools.

For defenders, BlackFog offers practical steps. Review third-party actions before using them and pin the full commit SHA in workflows. Give each CI/CD job only the secrets it needs, and use short-lived credentials through OIDC federation where possible.

Consider delaying extension and package updates on developer machines, and commit lock files. Teams can still apply security fixes quickly, but should know the Nx Console case shows how little time a bad update needs.

Teams should also limit public access to Docker APIs, Kubernetes control planes, Ray dashboards, and Redis servers. They should patch apps that use React Server Components against React2Shell (CVE-2025-55182).

If any indicator below turns up, rotate exposed credentials and check logs for signs that they were used. BlackFog also points to outbound traffic as a place to catch trouble.

Data exfiltration appeared in 96% of the attacks in its first-quarter 2026 ransomware analysis, though that figure covers BlackFog’s dataset and not TeamPCP alone.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Steal GitHub Tokens Through Malicious VS Code Extension That Remained Available for 18 Minutes appeared first on Cyber Security News.