Dangerous new malware targets macOS devices via OpenVSX extensions

Back Msn

Dangerous new malware targets macOS devices via OpenVSX extensions

Msn • February 7, 2026

Share: View original

GlassWorm malware campaign expanded from VS Code Marketplace to Open VSX · Four compromised extensions delivered macOS infostealer stealing browser ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malware Campaign Targets Open VSX Extension with 5,066 Downloads A sophisticated malware campaign has compromised the Open VSX extension marketplace, affecting over 5,000 developer workstations. The malicious package masqueraded as a legitimate Angular Language Service extension, embedding encrypted malware that activates upon opening HTML or TypeScript files. The attack utilized typosquatting and steganography techniques to evade detection. 20 sources 37

Extracted Entities

Attack Types (1)

Campaigns (1)

Glassworm Malware Campaign

Companies (1)

Malware (1)

MITRE ATT&CK (1)

T1195 - Supply Chain Compromise

Platforms (2)

MacOS VS Code Marketplace