Summary:
GlassWorm is a developer-focused supply-chain threat that abuses trusted Visual Studio Code themes and extensions to deliver hidden malware to developer endpoints. The campaign demonstrates how seemingly legitimate extensions can conceal obfuscated, encrypted, or otherwise malicious code within distributed packages, while public source repositories may appear harmless. Compromised extensions can execute scripts, download additional payloads, and potentially expose developer credentials, source code, cloud resources, and other sensitive assets. Organisations should therefore treat developer extensions as third-party software dependencies, validate distributed packages rather than relying solely on public source code, restrict unapproved extensions, monitor extension activity, and investigate endpoints where affected extensions were installed or executed.
Technical Description:
GlassWorm is characterized by heavily obfuscated JavaScript, encrypted payloads, and execution methods embedded within VS Code extension packages. The examined examples contain payloads concealed using invisible Unicode characters, JavaScript compressed into single-line code, and embedded stages protected by AES-256-CBC encryption.
While recovered JavaScript can execute in memory and interact with local system capabilities, one variant uses a Solana blockchain address as a dead-drop technique to retrieve follow-on infrastructure. Additionally, the campaign illustrates package-level differences, where executable functionality included in the distributed VSIX may not be visible in the related public source repository.
Technical indicators include extension.js and app.js entry points, temporary Windows command scripts, cmd.exe execution, encrypted JavaScript stages, and execution markers such as init.json. The details and technical aspects of the attack campaign are discussed further below.
Delivery and Infection Chain:
Victims encounter a Ukrainian-language fake CAPTCHA page hosted on uasputnik[.]com that instructs them to run an msiexec command. The command silently installs elita.msi from an attacker-controlled URL. The MSI presents itself as "Vertification" by "Internal Software," suppresses the installer wizard, hides its Add/Remove Programs options, requires no administrator privileges, and installs to a per-user path under %LOCALAPPDATA%. Its Upgrade table allows the operator to push updated payloads to already compromised systems.
The reported activity can be summarized as follows:
•
The user installs a malicious or compromised VS Code extension from the Visual Studio Marketplace or Open VSX, believing it to be a legitimate theme or developer utility.•
When the extension is activated, its embedded JavaScript executes on the developer workstation, with malicious code concealed through obfuscation, compression, or invisible Unicode characters.•
The extension decodes or decrypts the hidden payload and retrieves attacker-controlled instructions or additional content from external infrastructure.•
The downloaded content may be written to temporary locations and executed through native system processes, such as cmd.exe, while other variants execute retrieved JavaScript directly in memory.•
The resulting compromise can provide attackers with access to the developer environment and potentially expose credentials, tokens, source code, cloud resources, and other sensitive information accessible from the workstation.Technical Capabilities:
The analyzed GlassWorm samples demonstrate several capabilities designed to conceal execution and maintain flexible access to additional payloads. These include JavaScript obfuscation and compression, invisible Unicode characters for payload concealment, AES-256-CBC-encrypted stages, in-memory JavaScript execution, dynamic retrieval of remote content, Windows command-script execution, and environment-based execution conditions.
The Cosmic Nebula variant also uses Solana transaction memos as a dead-drop mechanism, allowing infrastructure to be changed without necessarily releasing a new extension version. The malware can therefore separate the initial extension from subsequent payload infrastructure, complicating static analysis and detection.
Attribution and Evolution:
Technical and development-level evidence links multiple extensions and repositories to the broader GlassWorm ecosystem. Investigators identified shared contributors, Git commit identities, recurring code and theme structures, Russian-language comments, reused welcome-page content, publisher relationships, and common technical artifacts.
The Cosmic Nebula sample provided particularly strong attribution evidence through the reuse of an encryption key, initialization vector, blockchain address, and execution characteristics associated with previously documented GlassWorm activity.
However, shared development indicators do not establish that every associated publisher account belongs to the same individual or that every related extension is actively malicious. The campaign therefore demonstrates an evolving ecosystem rather than a uniformly malicious set of packages.
Active Campaign and Geographic Spread:
The campaign has operated across both the Visual Studio Marketplace and Open VSX, expanding the potential victim population beyond a single extension ecosystem.
The investigated cluster included four Marketplace extensions and six Open VSX identities, with some related listings accumulating thousands or tens of thousands of downloads. At least two Marketplace extensions were confirmed to be malicious, while other cluster-linked extensions showed suspicious relationships without an active payload in the analyzed versions.
The available evidence does not establish the actual number of compromised users or provide a definitive geographic distribution of victims. However, the use of globally accessible developer marketplaces means the potential exposure is international rather than restricted to a particular region.
Conclusion:
GlassWorm highlights a significant weakness in the modern developer software supply chain: trust in an extension or its public repository does not guarantee the security of the package actually executed on an endpoint.
The campaign combines trusted developer ecosystems with code obfuscation, encrypted stages, dynamic infrastructure, and misleading publisher identities to make malicious functionality difficult to identify through conventional review.
Organizations should treat IDE extensions as third-party software dependencies, maintain an inventory of installed extensions, restrict extensions to approved publishers, inspect distributed packages rather than repositories alone, monitor extension-generated processes and network activity, and investigate affected endpoints for credential or secret exposure.
Impact:
The GlassWorm campaign can significantly impact developer environments by compromising workstations and potentially exposing credentials, API tokens, source code, cloud resources, and sensitive development data.
The execution of follow-on payloads may also enable further malware deployment or unauthorized access. Removing the malicious extension alone may not eliminate the risk, as stolen credentials or changes made during execution can persist after the extension is deleted.
IOC and Context Details:
| Topics | Details |
| Tactic Name | Execution, Command and Control, Credential Access, Discovery |
| Technique Name | Command and Scripting Interpreter, Application Layer Protocol, Obfuscated or Compressed Files or Information |
| Sub Technique Name | Windows Command Shell, Symmetric Cryptography, Obfuscated Files or Information |
| Attack Type | Malware |
| Targeted Applications | Visual Studio Code, Visual Studio Marketplace, Open VSX |
| Region Impacted | Global |
| Industry Impacted | Technology, Software Development, IT Services, Cloud, DevOps |
| IOC's | **SHA-256 Hashes:**<br>a276b76d3b00f302bb4dfb3690125c85ff472b16049c3c37476ac5e51096df07<br>5e68ca8c2097caccdb74d2752b85b85595a4bf646b442b8431a2416e87dbf268<br>684c877a52d226d50584cb886ca8ec5bec6355d4de853f406734c79d5b387804<br>da2d950e50326171adbff9c2bfd6f28998e32623ea7c2c475b9159a45cfb86bb<br>---<br>**Domains:**<br>fingercakes4sale[.]store<br>holiday-themes[.]dev<br>---<br>**URL:**<br>hxxps://fingercakes4sale[.]store/dsyuC |
| CVE | NA |
Recommended Actions:
•
Maintain an approved allowlist of VS Code extensions and restrict installation of unapproved extensions across developer endpoints.•
Inspect distributed VS Code extension packages, including VSIX files, rather than relying solely on the associated public source code or repository.•
Monitor VS Code extension activity for unusual child processes, command shell execution, script creation, and unexpected file modifications.•
Deploy endpoint detection controls to identify suspicious JavaScript execution, temporary command scripts, encoded or encrypted payloads, and abnormal process behavior.•
Monitor outbound network connections from developer workstations and investigate communication with unknown domains, newly registered infrastructure, and blockchain based dead drop mechanisms.•
Regularly inventory installed extensions across Visual Studio Code and Open VSX, including version, publisher, installation source, and activation status.•
If a malicious extension is identified, isolate the affected endpoint, remove the extension, investigate executed payloads, and rotate potentially exposed credentials, API keys, and access tokens.•
Establish continuous security reviews for developer tooling and reassess previously approved extensions when new threat intelligence or malicious activity associated with their publishers becomes available.Reference: