In May 2023, a Check Point cloud security research team detected malicious extensions on the Visual Studio Code (VSCode) marketplace, the free and popular open-source code editor developed by Microsoft. Malicious extensions can pose a serious security risk to users by installing malware, stealing PII and user data, or performing other harmful actions. Check Point found and disclosed several malicious extensions to the VSCode team with a total count of more than 45,000 installs. The objectives for Check Point were to quickly alert VSCode users and the public at large about Check Point’s discovery of the malicious extensions; to reinforce its position as a leading cybersecurity company; and increase attention of and drive traffic to Check Point’s blog not only as the go-to resource for information about the VSCode malicious extension findings, but also for information on other cybersecurity incidents and discoveries.

To share their findings publicly, the internal cloud security research and marketing teams at Check Point developed a comprehensive blog post detailing the discovery, disclosure, and pertinent details about the VSCode malicious extensions that they intended to publish and syndicate across their social media channels. To further amplify this approach and meet the stated objectives, Pugh & Tiller devised a media outreach strategy to target a small, but specific list of cybersecurity reporters who cover malicious extensions and similar attacks and use the Check Point blog as the primary source reference. Because of the subject’s sensitivity and need for reporters to write about the discovery quickly, Pugh & Tiller advised Check Point to make the blog link private temporarily and available only to those media who received it directly under embargo, at which point the blog would go live. By using this approach, coverage would be synched with the blog’s public posting and, more importantly, give the right reporters time to craft a thorough story about the VSCode research.