Malicious VS Code Extension Shows GlassWorm Tradecraft Overlap

Du'aine Davis

Observed in the wild

• A malicious VS Code extension impersonating “Material Icon Theme” (v5.29.1) was discovered in late November 2025. Its Mach-O binary contains a user-path string identical in style to GlassWorm samples, a distinctive technical overlap. This finding comes amid a confirmed resurgence of GlassWorm activity, as reported by SecureAnnex.
• The extension’s loader (extension.js) deployed Rust implants (os.node for Windows, darwin.node for macOS). These implants used Solana blockchain-based C2, AES‑256‑CBC encrypted payloads, and a Google Calendar fallback channel—tactics previously associated with GlassWorm. The Mach-O path artefact reinforces continuity in tradecraft, suggesting toolkit reuse or evolution.
• Remove the malicious theme immediately, scan for implants using Microsoft Defender (focus on VS Code extension directories), and monitor for outbound traffic to Solana wallets or calendar APIs. Configure Defender rules to detect native binary execution from extension paths and blockchain-related network activity. These steps help identify behaviour consistent with this threat family.

Analysis of the Rust implants found in the malicious VS Code extension - Nextron Systems
Glassworm's resurgence | Secure Annex

Du'aine Davis

Trojan Hidden in Fake PNG Targets VS Code Marketplace
Observed in the wild

• Researchers uncovered a campaign involving 19 malicious Visual Studio Code extensions on the official Marketplace, active since February and detected on 2 December. These extensions, some impersonating popular tools, were downloaded by developers worldwide, introducing malware into trusted development environments.
• Threat actors embedded Rust-based trojans and JavaScript droppers inside modified dependencies (e.g., path-is-absolute), concealed within files masquerading as PNG images. The attack chain leveraged cmstp.exe (a Windows LOLBIN) for execution, using obfuscation techniques like Base64 encoding and reversed strings to evade detection.
• Organisations should audit installed VS Code extensions, monitor for suspicious behaviour such as unexpected cmstp.exe execution, and enforce Microsoft Defender for Endpoint rules to block LOLBIN abuse. Defender’s Attack Surface Reduction (ASR) policies and behavioural monitoring for anomalous script execution are strongly recommended to prevent similar supply chain compromises.

VS Code extensions contain trojan-laden fake image | ReversingLabs