Malicious VS Code Extension Shows GlassWorm Tradecraft Overlap

Du'aine Davis · 2025-12-02T10:55:36+00:00

Observed in the wild * A malicious VS Code extension impersonating “Material Icon Theme” (v5.29.1) was discovered in late November 2025. Its Mach-O binary contains a user-path string identical in style to GlassWorm samples, a distinctive technical overlap. This finding comes amid a confirmed resurgence of GlassWorm…

Du'aine Davis

Observed in the wild

A malicious VS Code extension impersonating “Material Icon Theme” (v5.29.1) was discovered in late November 2025. Its Mach-O binary contains a user-path string identical in style to GlassWorm samples, a distinctive technical overlap. This finding comes amid a confirmed resurgence of GlassWorm activity, as reported by SecureAnnex.
The extension’s loader (extension.js) deployed Rust implants (os.node for Windows, darwin.node for macOS). These implants used Solana blockchain-based C2, AES‑256‑CBC encrypted payloads, and a Google Calendar fallback channel—tactics previously associated with GlassWorm. The Mach-O path artefact reinforces continuity in tradecraft, suggesting toolkit reuse or evolution.
Remove the malicious theme immediately, scan for implants using Microsoft Defender (focus on VS Code extension directories), and monitor for outbound traffic to Solana wallets or calendar APIs. Configure Defender rules to detect native binary execution from extension paths and blockchain-related network activity. These steps help identify behaviour consistent with this threat family.

Analysis of the Rust implants found in the malicious VS Code extension - Nextron Systems
Glassworm's resurgence | Secure Annex

Find more posts tagged with

Threat Landscape

Sign in to participate and unlock exclusive content 🔓

It looks like you're new here! Sign in or register to be able to comment, access member-only content and follow the spaces relevant to you.

Comments

Du'aine Davis

Trojan Hidden in Fake PNG Targets VS Code Marketplace
Observed in the wild

Researchers uncovered a campaign involving 19 malicious Visual Studio Code extensions on the official Marketplace, active since February and detected on 2 December. These extensions, some impersonating popular tools, were downloaded by developers worldwide, introducing malware into trusted development environments.
Threat actors embedded Rust-based trojans and JavaScript droppers inside modified dependencies (e.g., path-is-absolute), concealed within files masquerading as PNG images. The attack chain leveraged cmstp.exe (a Windows LOLBIN) for execution, using obfuscation techniques like Base64 encoding and reversed strings to evade detection.
Organisations should audit installed VS Code extensions, monitor for suspicious behaviour such as unexpected cmstp.exe execution, and enforce Microsoft Defender for Endpoint rules to block LOLBIN abuse. Defender’s Attack Surface Reduction (ASR) policies and behavioural monitoring for anomalous script execution are strongly recommended to prevent similar supply chain compromises.

VS Code extensions contain trojan-laden fake image | ReversingLabs

Du'aine Davis

Glassworm Malware Campaign Built from Multiple Open‑Source Components
Observed in the wild

Researchers identified an active malware campaign, named “Four Arms, One Monster”, abusing multiple open‑source components to deliver a single, flexible threat. The activity was observed in late 2025-early 2026 and primarily impacts Windows environments, with victims appearing opportunistic rather than sector‑specific, suggesting broad targeting of organisations and individuals via common infection vectors.
The campaign combines four distinct “arms” (loader, RAT, stealer, and auxiliary tooling) into one modular framework. Initial access is achieved through phishing or malicious downloads, followed by staged payload delivery. The tooling is largely open‑source or lightly modified, indicating a financially motivated threat actor prioritising speed, reuse, and adaptability over bespoke malware development.
Organisations should monitor Microsoft Defender for Endpoint for suspicious LOLBins (e.g. PowerShell, rundll32, mshta) spawning network connections, unusual child‑process chains, and post‑infection credential access behaviour. Enable Attack Surface Reduction rules, restrict script execution, audit outbound C2 traffic from user endpoints, and alert on unsigned binaries dropped into user‑writable directories.

Four Arms, One Monster: GlassWorm Invades GitHub, NPM, VS Code and PyPI | OpenSource Malware Blog

Du'aine Davis

GlassWorm Expands into Malicious Chrome Extensions
Observed in the wild

In March, researchers uncovered a new GlassWorm capability force‑installing a malicious Chrome extension on already‑compromised systems. The campaign primarily impacts software developers and users exposed via poisoned npm, PyPI, GitHub, and OpenVSX projects. Infections enabled persistent browser‑level surveillance and credential theft beyond earlier GlassWorm supply‑chain compromises.
The activity is attributed to the same GlassWorm threat actor previously abusing open‑source ecosystems. After initial installation via compromised or trojanised packages, a multi‑stage loader deploys a persistent RAT which silently installs a fake “Google Docs Offline” Chrome extension. The extension enables keylogging, cookie and session token theft, screenshots, and live command execution via blockchain‑backed C2 infrastructure.
Organisations are advised to treat unauthorised browser extensions as a high‑risk signal. Use Microsoft Defender for Endpoint to monitor suspicious Chrome extension installations, abnormal Node.js or PowerShell persistence, and unsigned child processes in user profiles. Enforce extension allow‑listing, review developer endpoint security, and hunt for credential access from browser data stores or unexpected outbound connections linked to Solana or DHT‑based C2 behaviour.

GlassWorm RAT Delivered via Malicious Chrome Extension (Keylogger, Cookie Theft)

See what's trending

Click on a tag to discover all the published content related to it.