Loading threat actor…
BigBlack is the publisher name associated with malicious Visual Studio Code extensions used to target software developers with information-stealing malware. The activity involved extensions masquerading as benign developer tools, including a color theme and an AI assistant, to gain execution inside Visual Studio Code environments. The extensions were designed to trigger automatically and deploy a legitimate executable together with a malicious dynamic-link library, using DLL sideloading or hijacking to execute the payload while reducing suspicion. The malware associated with BigBlack focused on credential and data theft rather than ransomware or destructive effects. Reported collection objectives included browser cookies, session tokens, stored credentials, cryptocurrency wallet data, clipboard contents, Wi-Fi credentials, screenshots, process listings, installed-program inventories, and general system information. The malware also launched Chromium-based browsers in headless mode to facilitate session hijacking and theft of browser-resident data. The operation additionally searched infected systems for passwords and targeted cryptocurrency wallets, indicating overlap between credential theft and crypto-theft objectives. Observed tradecraft included initial access through trojanized IDE extensions, hidden script-based payload retrieval, defense evasion through use of legitimate software as a loader, and post-compromise data collection and exfiltration. BigBlack is best characterized as a malicious software distribution identity tied to a developer-focused infostealer campaign. No high-confidence attribution to a nation state or specific country of origin is currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.