--- title: From Extension to Infection: An In-Depth Analysis of the... description: The Evelyn Stealer campaign weaponizes Visual Studio Code extensions to deploy multistage information-stealing malware targeting software developers. The... canonical: https://daily.dev/posts/from-extension-to-infection-an-in-depth-analysis-of-the-evelyn-stealer-campaign-targeting-software--owlthzs3f twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers | daily.dev og:description: The Evelyn Stealer campaign weaponizes Visual Studio Code extensions to deploy multistage information-stealing malware targeting software developers. The... og:url: https://daily.dev/posts/from-extension-to-infection-an-in-depth-analysis-of-the-evelyn-stealer-campaign-targeting-software--owlthzs3f og:image: https://api.daily.dev/og/posts/oWlthzs3f.png og:image:alt: From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers **[Trend Micro](https://daily.dev/sources/trendmicro)** · 8 min read · 0 upvotes · 0 comments ## Summary The Evelyn Stealer campaign weaponizes Visual Studio Code extensions to deploy multistage information-stealing malware targeting software developers. The attack chain uses DLL sideloading, process hollowing with AES-256-CBC encryption, and advanced anti-analysis techniques including VM detection and debugger evasion. The malware harvests browser credentials through DLL injection, captures screenshots, steals cryptocurrency wallets, and exfiltrates data via FTP. It employs sophisticated browser manipulation with headless execution and disabled security features. The campaign demonstrates operational maturity with detailed filename tracking and comprehensive system reconnaissance, positioning developers as high-value targets due to their privileged access to organizational systems and digital assets. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#vscode](https://daily.dev/tags/vscode), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/from-extension-to-infection-an-in-depth-analysis-of-the-evelyn-stealer-campaign-targeting-software--owlthzs3f) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers","url":"https://daily.dev/posts/from-extension-to-infection-an-in-depth-analysis-of-the-evelyn-stealer-campaign-targeting-software--owlthzs3f","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/from-extension-to-infection-an-in-depth-analysis-of-the-evelyn-stealer-campaign-targeting-software--owlthzs3f"},"datePublished":"2026-01-19T11:37:39.597Z","dateModified":"2026-02-28T04:13:28.259Z","description":"The Evelyn Stealer campaign weaponizes Visual Studio Code extensions to deploy multistage information-stealing malware targeting software developers. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2ec65b246a6f7c4605bcd7b153ac32e2?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2ec65b246a6f7c4605bcd7b153ac32e2?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Trend Micro","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trend Micro","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/4f418451d6564f28bd27a89e0174d948","url":"https://daily.dev/sources/trendmicro"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/from-extension-to-infection-an-in-depth-analysis-of-the-evelyn-stealer-campaign-targeting-software--owlthzs3f","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,vscode,reverse-engineering","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trend Micro","item":"https://daily.dev/sources/trendmicro"},{"@type":"ListItem","position":3,"name":"From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers"}]} ```