Glassworm malware returns in third wave of malicious VS Code packages
Recorded: Dec. 1, 2025, 11:02 p.m.
| Original | Summarized |
Glassworm malware returns in third wave of malicious VS Code packages News Featured GreyNoise launches free scanner to check if you're part of a botnet The Cyber Monday 2025 Cybersecurity, IT, VPN, & Antivirus Deals Microsoft to secure Entra ID sign-ins from script injection attacks New ShadowV2 botnet malware used AWS outage as a test opportunity Glassworm malware returns in third wave of malicious VS Code packages SmartTube YouTube app for Android TV breached to push malicious update Microsoft says new Outlook can't open some Excel attachments Retail giant Coupang data breach impacts 33.7 million customers Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Virus Removal Guides Latest Remove the Theonlinesearch.com Search Redirect Remove the Smartwebfinder.com Search Redirect How to remove the PBlock+ adware browser extension Remove the Toksearches.xyz Search Redirect Remove Security Tool and SecurityTool (Uninstall Guide) How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Antivirus 2009 (Uninstall Instructions) Locky Ransomware Information, Help Guide, and FAQ CryptoLocker Ransomware Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ Downloads Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Startup Database HomeNewsSecurityGlassworm malware returns in third wave of malicious VS Code packages
Glassworm malware returns in third wave of malicious VS Code packages By Bill Toulas December 1, 2025 The Glassworm campaign, which first emerged on the OpenVSX and Microsoft Visual Studio marketplaces in October, is now in its third wave, with 24 new packages added on the two platforms. Legitimate (left) and impersonator (right) packagesSource: Secure Annex Confusing search resultsSource: Secure Annex PayloadSource: Secure Annex Break down IAM silos like Bitpanda, KnowBe4, and PathAI Related Articles: Coding Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Leak confirms OpenAI is preparing ads on ChatGPT for public roll out Microsoft: Windows updates make password login option invisible Public GitLab repositories exposed more than 17,000 secrets Sponsor Posts Review of Passwork: Affordable Enterprise-Grade Password Manager Overdue a password health-check? Audit your Active Directory for free Hackers love the holidays! Share FREE Security Awareness Training to keep family & friends cyber-safe! Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
The Glassworm malware campaign, now in its third wave, continues to target Visual Studio Code (VS Code) developers through malicious packages distributed across both the OpenVSX and Microsoft Visual Studio Marketplace repositories. This ongoing activity underscores the persistent threat of supply chain attacks, particularly those exploiting the trust placed in widely used developer tools. As detailed by Bill Toulas of BleepingComputer, the initial emergence of Glassworm in October 2025, involving the use of “invisible Unicode characters” to conceal its code, has been followed by a cyclical return of the malware, demonstrating a sophisticated persistence strategy. The third wave, identified by Secure Annex researcher John Tuckner, leverages 24 new packages across both platforms, each designed to mimic legitimate, popular developer tools and frameworks—including Flutter, Vim, YAML, Tailwind, Svelte, React Native, and Vue. This impersonation tactic is a key element of the attack, increasing the chances of developers unwittingly installing the malicious code. The packages utilized include names such as ‘iconkieftwo.icon-theme-materiall’, ‘prisma-inc.prisma-studio-assistance’, and ‘prettier-vsc.vsce-prettier,’ making them appear as legitimate extensions. Following acceptance onto the marketplaces, malicious publishers then deploy updates containing the core Glassworm payload. Critically, they inflate download counts, manipulating search results to elevate the apparent legitimacy of the extensions. This manipulation aims to mask the malicious nature of the code, increasing the likelihood that developers will install it simply because it appears to be a popular and widely used tool. The malware employs both the original Unicode obfuscation technique and now incorporates Rust-based implants within the extensions, demonstrating an evolution of the attack’s sophistication. Secure Annex's investigation found that the attack’s supply chain nature is being exploited, utilizing well-established VS Code extension repositories as entry points. Key elements of the attack include the use of SOCKS proxies to redirect malicious traffic, alongside the installation of the HVNC client for stealthy remote access capabilities. The continuous rotation of access tokens by OpenVSX further complicates detection and response efforts. The continued success of Glassworm highlights vulnerabilities within the software supply chain and the potential for adversaries to exploit trust in popular development tools. BleepingComputer is currently awaiting responses from both OpenVSX and Microsoft regarding the continued ability of Glassworm to bypass their existing defenses. This ongoing situation necessitates heightened vigilance within the developer community and underscores the importance of robust security practices, including thorough code review, verification of extension sources, and the use of security scanners. |