{
  "schema_version": "1.6.0",
  "id": "CLR-2026-3045",
  "modified": "2026-09-03T10:39:43Z",
  "published": "2026-09-03T10:39:43Z",
  "summary": "AzureCdnInfo.edrtester — a VS Code extension that beacons out with host recon behind HTTP Host-header domain fronting",
  "details": "A Visual Studio Code Marketplace extension (AzureCdnInfo.edrtester 1.0.4) that, on activation, fingerprints the machine and its Windows domain, then beacons to an attacker endpoint every 150 seconds — reaching one host on the wire while presenting a spoofed Host: header for another (HTTP domain fronting, not SNI). A reverse shell and an AES-decrypt routine are bundled but the reverse shell is dormant in this build.",
  "affected": [
    {
      "package": {
        "ecosystem": "VSCode",
        "name": "AzureCdnInfo.edrtester"
      },
      "versions": [
        "1.0.4"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3045-edrtester"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3045",
    "kind": "malware",
    "class": "malware · beaconing backdoor",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [],
      "hashes": [
        "sha256:eebb86f9d25df589229ce17cb2ee98c3b37f79739f4abb608171ed64977cbb77",
        "sha256:0615802ff0a30b46b159a064bd63ae7a58bab0097c215bce608f4c67306bfeaf",
        "sha256:acd8833a51e369f4d5638191322bd14196d6960dd70b3b5142d91d8daf92cec5",
        "sha256:28d6e35c0c6dbbb149a8f15f01dc278b76c40eb72dfb20472d6bb367c41d3e39",
        "sha256:d4101a5bc86747f499ef347548e92eb3e1b09ce6acaf34bd1ee07f66400b18af"
      ],
      "indicators": [
        "Beacon TCP endpoint (on the wire): xeroshoes[.]com:80, path /bcon/",
        "Spoofed Host: header (domain fronting): officeupdate.southeast.cloudapp.azure-cdn[.]info",
        "Commented-out / dormant secondary host: goofy.japaneast.cloudapp.azure[.]com",
        "Beacon cadence: immediate on activation, then every 150 seconds",
        "Payload extension/edrdrill.js sha256 eebb86f9d25df589229ce17cb2ee98c3b37f79739f4abb608171ed64977cbb77",
        "Entrypoint extension/extension.js sha256 0615802ff0a30b46b159a064bd63ae7a58bab0097c215bce608f4c67306bfeaf",
        "AD recon extension/ext.dns.js sha256 acd8833a51e369f4d5638191322bd14196d6960dd70b3b5142d91d8daf92cec5",
        "Logging helper extension/ext.logging.js sha256 28d6e35c0c6dbbb149a8f15f01dc278b76c40eb72dfb20472d6bb367c41d3e39",
        "Full VSIX artifact sha256 d4101a5bc86747f499ef347548e92eb3e1b09ce6acaf34bd1ee07f66400b18af"
      ]
    },
    "malicious_files": [
      {
        "path": "extension/extension.js",
        "sha256": "0615802ff0a30b46b159a064bd63ae7a58bab0097c215bce608f4c67306bfeaf",
        "role": "VS Code activation entrypoint — loads the payload on activate()"
      },
      {
        "path": "extension/edrdrill.js",
        "sha256": "eebb86f9d25df589229ce17cb2ee98c3b37f79739f4abb608171ed64977cbb77",
        "role": "core payload: host recon, 150s HTTP beacon with Host-header domain fronting, AES-decrypt, dormant reverse shell (phone_home, not dispatched in this build)"
      },
      {
        "path": "extension/ext.dns.js",
        "sha256": "acd8833a51e369f4d5638191322bd14196d6960dd70b3b5142d91d8daf92cec5",
        "role": "Active Directory recon — domain controller / PDC discovery via DNS SRV + reverse lookups"
      }
    ]
  }
}