Security Warning: Axqua VS Code Extension v1.0.24 Identified as Malware

A security review of the axqua.axqua v1.0.24 VS Code extension bundle identifies it as malware. The extension, discovered via a free Claude Opus promotion, contains code that executes specific malicious actions on Windows systems after a user logs in.

Malicious Behavior

The extension bundle performs the following actions without user confirmation:

• Silent Execution: Downloads a server-selected EXE or ZIP file and launches it in the background using cmd.exe.
• Obfuscation: Generates filenames with prefixes such as svchost, wuauclt, and msupdate to mimic legitimate system processes.
• Cleanup: Attempts to delete the downloaded EXE file three seconds after launch to hide evidence.