Rapid7

module

VS Code Extension Persistence

Try Surface Command
Back to search
Disclosed
Apr 29, 2015
Created
Jun 11, 2026

Description

This module installs a malicious VS Code extension into the target's
VS Code extensions directory. The extension executes the payload each time
VS Code is launched, providing persistent code execution. Supports VS Code,
VS Code Insiders, VSCodium, VS Code Server, and Cursor.

Tested against 1.120.0 on Kali and Windows 10

Author

h00die

Platform

Linux,Unix,Windows

Architectures

cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/multi/persistence/vscode_extension
    msf exploit(vscode_extension) > show targets
        ...targets...
    msf exploit(vscode_extension) > set TARGET < target-id >
    msf exploit(vscode_extension) > show options
        ...show and set options...
    msf exploit(vscode_extension) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report