MAL-2026-16010 Malicious code in AzureCdnInfo.edrtester (VSCode)

The Visual Studio Code Marketplace extension AzureCdnInfo.edrtester (version 1.0.4) presents as an EDR/telemetry test utility but is a beaconing backdoor. On activation, extension.js loads edrdrill.js, which performs host reconnaissance — hostname, current working directory and local IP — and resolves the Windows domain controller / PDC via DNS SRV and reverse lookups (ext.dns.js: queryDC() / queryPDC()).

It then opens an outbound beacon, immediately on activation and every 150 seconds thereafter (setUpBeaconing() on a setInterval), via an http.request to xeroshoes.com:80 on path /bcon/ — but it sets the Host: header to officeupdate.southeast.cloudapp.azure-cdn.info and a decoy browser User-Agent. Because the TCP peer and the advertised host differ, this is HTTP Host-header domain fronting (not SNI). The beacon exfiltrates hostname, local IP and a timestamp under the decoy identity.

A reverse-shell function (phone_home()) and an AES-decrypt routine are bundled, but in this build the reverse shell is not dispatched (no command handler wires it up) and a second endpoint goofy.japaneast.cloudapp.azure.com is commented out, so the active scope is host reconnaissance plus beaconing. The dormant remote-command capability is a trivial change away from being armed. Analysis was static (code + dataflow) on the inert VSIX; no installation, execution, or live callback was performed.

Detected and classified independently by codelake Research from the VS Code Marketplace feed; at the time of reporting AzureCdnInfo.edrtester was not present in OSV or GHSA (a first-catch).