Ankura CTIX FLASH Update - October 17, 2025

Malware Activity

Malicious Developer Extensions and Cisco Device Exploits

Cybersecurity experts have identified two (2) significant ongoing threats. First, a malicious actor known as TigerJack targets developers by creating harmful extensions for platforms like Microsoft's VSCode marketplace and OpenVSX, an open-source alternative. These extensions (some downloaded thousands of times), contain dangerous features such as stealing source code, secretly mining cryptocurrency, and executing malicious commands from remote servers. Despite some being removed from VSCode, TigerJack continues re-uploading similar malicious tools under different names. Operating with multiple fake accounts to appear legitimate and to push new payloads without updating the extensions. Second, researchers uncovered Operation Zero Disco. A cyberattack campaign exploiting a recent security flaw in older Cisco devices. The flaw, CVE-2025-20352, allowed hackers to remotely execute malicious