Cybersecurity researchers have published a new set of three extensions related to the GlassWorm campaign. This marks an ongoing attempt by some threat actors to target the Visual Studio Code (VS Code) ecosystem.
The extension in question is still available for download and is listed below.
GlassWorm, first documented by Koi Security late last month, refers to a campaign in which attackers leveraged the Open VSX registry and VS Code extensions from the Microsoft Extension Marketplace to harvest Open VSX, GitHub, and Git credentials, exfiltrate funds from 49 different cryptocurrency wallet extensions, and drop additional tools for remote access.
What’s notable about this malware is that it uses invisible Unicode characters to hide its malicious code in the code editor, and exploits stolen credentials to compromise additional extensions, effectively creating a self-replicating cycle that can further expand its reach and spread in a worm-like manner.
In response to the findings, Open VSX announced that as of October 21, 2025, it has identified and removed all malicious extensions and rotated or revoked the associated tokens. However, a new report from Koi Security shows that this threat has resurfaced again, using the same invisible Unicode character obfuscation trick to evade detection.
“The attacker posted a new transaction to the Solana blockchain and provided an updated C2 [command-and-control] It is an endpoint for downloading the next stage payload,” said security researchers Idan Dardikman, Yuval Ronen, and Lotan Sery.
“This shows the resilience of blockchain-based C2 infrastructure. Even if the payload server goes down, an attacker can post a new transaction for as little as a penny, and all infected machines automatically get a new location.”
The security vendor also revealed that it had identified endpoints that were allegedly accidentally exposed on the attacker’s servers, and revealed a partial list of victims across the United States, South America, Europe, and Asia. This includes major government agencies in the Middle East.
Further analysis revealed keylogger information that appears to be from the attacker’s own machine, providing some clues as to GlassWorm’s origins. The attacker is believed to be Russian-speaking and is said to be using an open-source browser extension C2 framework named RedExt as part of its infrastructure.
“These may be real organizations or real people whose credentials have been collected, whose machines may be acting as a criminal proxy infrastructure, and whose internal networks may have already been compromised,” Koi Security said.
This development comes shortly after Aikido Security published research showing that GlassWorm has expanded its targeting to GitHub and that stolen GitHub credentials are being used to push malicious commits to repositories.
Source link
