GlassWorm Malware Campaign Targets macOS via Malicious VS Code Extensions
A new wave of the GlassWorm malware campaign is actively targeting macOS users by distributing trojanized Visual Studio Code (VS Code) extensions through the OpenVSX marketplace. This fourth iteration marks a significant shift from previous campaigns, which primarily targeted Windows systems, and now leverages AES-256-CBC–encrypted JavaScript payloads embedded in extensions such as studio-velte-distributor.pro-svelte-extension, cudra-production.vsce-prettier-pro, and Puccin-development.full-access-catppuccin-pro-extension. The malware is designed to steal credentials for platforms like GitHub, npm, and OpenVSX, as well as cryptocurrency wallet data, and it supports remote access via VNC and SOCKS proxy routing. Notably, the latest campaign employs AppleScript for execution on macOS and introduces a 15-minute delay before activating its malicious logic, a tactic intended to evade detection by automated sandbox analysis.
Researchers from Koi Security identified that the threat actor behind GlassWorm has adapted its techniques over four distinct waves since October, evolving from using invisible Unicode characters and compiled Rust binaries to the current encrypted JavaScript approach. The malware's command and control infrastructure is now based on the Solana blockchain, utilizing transaction memos with base64-encoded URLs to maintain decentralized and resilient control, making takedown efforts extremely challenging. Over 50,000 downloads of the malicious extensions have been recorded, and the campaign's infrastructure has been linked to previous waves through shared IP addresses and encryption keys. The sophistication and persistence of GlassWorm highlight the growing threat to macOS developers and users who rely on third-party extension marketplaces for their development environments.
Timeline
Dec 31, 2025
Researchers report wallet replacement feature not yet fully active
As of late December 2025, analysts found that the wallet trojanization mechanism existed in the malware code but was not yet fully functional or active in observed infections.
Dec 31, 2025
GlassWorm adds code to trojanize Ledger Live and Trezor Suite
The latest wave introduced functionality intended to replace Ledger Live and Trezor Suite with trojanized versions, expanding the campaign from credential theft to hardware wallet compromise on macOS.
Dec 31, 2025
Researchers identify three related GlassWorm extensions and technical tradecraft
Koi Security analysts linked three malicious extensions to the same campaign through shared infrastructure and encryption keys, and documented AES-256-CBC encrypted JavaScript payloads, a 15-minute sandbox-evasion delay, Solana-based C2, and macOS persistence and credential-theft techniques.
Dec 31, 2025
Malicious GlassWorm extensions reach tens of thousands of downloads
The identified malicious VS Code/OpenVSX extensions accumulated significant reach, with reports citing more than 33,000 and over 50,000 downloads, suggesting broad exposure among developers despite possible count manipulation.
Dec 31, 2025
Fourth GlassWorm wave shifts from Windows to macOS via Open VSX extensions
By late 2025, the threat actor launched a fourth wave targeting macOS developers through malicious Visual Studio Code extensions published on the Open VSX marketplace, marking a strategic pivot from prior Windows-focused attacks.
Oct 1, 2025
GlassWorm campaign begins with first wave targeting Windows users
Researchers said the GlassWorm operation has evolved across four distinct waves since October, indicating the campaign began in October 2025 with earlier activity focused on Windows systems.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Malware
Organizations
Affected Products
Sources
Related Stories
GlassWorm Supply Chain Attack via Malicious VS Code and Open VSX Extensions
The GlassWorm malware campaign has resurfaced with a third wave of attacks, distributing 24 malicious extensions across the Microsoft Visual Studio Marketplace and Open VSX repositories. These extensions impersonate popular developer tools and frameworks such as Flutter, React, Tailwind, Vim, and Vue, aiming to compromise developer environments. Once installed, the malware attempts to steal credentials for GitHub, npm, and OpenVSX accounts, as well as cryptocurrency wallet data, and can turn infected machines into attacker-controlled nodes for further criminal activity. The attackers have also been observed artificially inflating download counts to increase the visibility and perceived trustworthiness of their malicious extensions. GlassWorm employs advanced evasion techniques, including the use of invisible Unicode characters to hide malicious code and the deployment of a SOCKS proxy and HVNC client for stealthy remote access. Despite previous efforts by Microsoft and Open VSX to remove infected packages and rotate compromised access tokens, the threat actors have continued to return with new publisher accounts and updated extensions. The campaign highlights the ongoing risks in the software supply chain, particularly for developers relying on third-party extensions from public repositories.
4 days ago
GlassWorm Supply Chain Attack on Visual Studio Code Extensions
A sophisticated supply chain attack has targeted Visual Studio Code (VS Code) extensions, leveraging a self-propagating worm known as GlassWorm. Security researchers at Koi Security discovered the malware after identifying suspicious behavior in an extension called CodeJoy on the OpenVSX marketplace. The worm employs a novel technique using invisible Unicode characters, making the malicious code undetectable to the human eye within code editors. This approach allows the malware to evade traditional detection methods and remain stealthy within compromised extensions. GlassWorm utilizes the Solana blockchain as its primary command-and-control (C2) channel, with Google Calendar serving as a backup C2 infrastructure, enhancing its resilience and making takedown efforts more challenging. The worm has already infected nearly 36,000 developer machines, indicating a significant impact on the developer ecosystem. Once installed, GlassWorm harvests credentials from NPM, GitHub, and Git, enabling it to propagate further by compromising additional packages and extensions. The malware also targets cryptocurrency wallets, seeking to steal digital assets from affected users. Infected systems are converted into SOCKS proxy servers, effectively turning developer machines into part of the attacker's extended C2 infrastructure. Additionally, GlassWorm installs hidden virtual network computing (VNC) servers, granting attackers full remote access to compromised machines. The attack highlights the growing risks associated with open-source marketplaces and the potential for widespread compromise through popular development tools. Security experts emphasize the importance of scrutinizing extension code and implementing stronger guardrails in extension marketplaces to prevent similar attacks. The use of invisible Unicode and blockchain-based C2 channels represents a significant evolution in malware stealth and persistence. The incident underscores the need for developers and organizations to monitor for unusual extension behavior and to regularly audit installed extensions for signs of compromise. The attack also demonstrates the potential for supply chain threats to rapidly scale, given the interconnected nature of developer tools and platforms. As the investigation continues, security vendors and marketplace operators are working to identify and remove malicious extensions and to strengthen defenses against future supply chain attacks.
1 weeks ago
Open VSX Registry Supply-Chain Attack Spreads GlassWorm via Compromised VSCode Extensions
A supply-chain compromise of the **Open VSX Registry** led to malicious updates being pushed to legitimate Visual Studio Code extensions after attackers gained access to a developer’s publishing credentials (likely via a leaked token or other unauthorized access). Reporting indicates four established extensions from the `oorzc` publisher were trojanized and distributed via Open VSX before being removed, with prior legitimate adoption measured in the tens of thousands of downloads and subsequent exposure affecting downstream developer environments. The injected payload delivered the **GlassWorm** malware/loader, which executes via obfuscated JavaScript embedded in the extension and includes environment checks (notably avoiding execution on **Russian-locale** systems). Technical details describe a multi-stage loader with capabilities aligned to credential and data theft, including macOS credential and cryptocurrency wallet targeting, and use of techniques such as **EtherHiding** to retrieve command-and-control infrastructure dynamically; defenders are advised to identify and remove affected extension versions and review developer endpoints for signs of compromise and credential/token leakage.
1 months ago