GlassWorm Malware: What It Is and How to Remove It - 2

Do it yourself · free Remove GlassWorm (VS Code extension worm and stealer) yourself 5 steps, 15 minutes, no software needed.

GlassWorm (VS Code extension worm and stealer): summary

Facts checked on 23 October 2026 against the abuse.ch ThreatFox listing held in our data and against published reports by Veracode, the Eclipse Foundation, Koi Security and BleepingComputer.

We read these through results and the pages they summarise; we opened no malware, installed no extension and infected no machine. The steps follow the vendors' lists of what is stolen and general operating system menus, and were not tried on a live infection.

What GlassWorm is, and what we know it

GlassWorm is not one file you download by hand. It is a campaign: attackers put malicious code into extensions for Visual Studio Code and for editors that use the Open VSX registry, and the code runs on a developer's computer when the editor starts. We read published research from Veracode, the Eclipse Foundation (which runs Open VSX), Koi and BleepingComputer, and what follows is what those sources say, plus what our own data shows.

Our own data is thin. The abuse.ch project ThreatFox lists one entry with the malware name GlassWorm, seen on 21 October 2026. There are no URLhaus reports and no domain to test, so we ran no site check. We do not know what that single ThreatFox entry points to, and we did not open it.

1 Who found it and when Koi Security documented GlassWorm in October 2025. Reports say seven Open VSX extensions were compromised on 17 October 2025, and that one extension on Microsoft's own VS Code marketplace was also affected until Microsoft removed it after Koi reported it. One vendor estimates 35,800 installs of affected extensions. Counts differ between sources, so read them as estimates.

Who found it and when

Koi Security documented GlassWorm in October 2025. Reports say seven Open VSX extensions were compromised on 17 October 2025, and that one extension on Microsoft's own VS Code marketplace was also affected until Microsoft removed it after Koi reported it. One vendor estimates 35,800 installs of affected extensions. Counts differ between sources, so read them as estimates.

2 Why the word worm Koi called it the first self spreading worm of its kind: the malware steals the tokens that developers use to publish extensions and packages, then uses them to poison more extensions. The Eclipse Foundation disputes the label. Its position is that the code does not jump from machine to machine by itself, and that it first has to steal credentials before it can reach further. Both views agree on the loop of theft and reuse.

Koi called it the first self spreading worm of its kind: the malware steals the tokens that developers use to publish extensions and packages, then uses them to poison more extensions. The Eclipse Foundation disputes the label. Its position is that the code does not jump from machine to machine by itself, and that it first has to steal credentials before it can reach further. Both views agree on the loop of theft and reuse.

3 What it hides behind Veracode and others describe code written with invisible Unicode characters, the variation selectors and private use characters that an editor draws as nothing. A person reading the file sees blank space, while a small decoder in the extension turns those characters back into running code. This is why ordinary code review missed it.

Veracode and others describe code written with invisible Unicode characters, the variation selectors and private use characters that an editor draws as nothing. A person reading the file sees blank space, while a small decoder in the extension turns those characters back into running code. This is why ordinary code review missed it.

4 How it finds its stage Sources say the malware reads a Solana blockchain transaction to learn where to fetch the piece, with a Google Calendar entry as a backup. A blockchain record cannot be taken down like a normal server, which makes the control channel hard to cut.

How it finds its stage

Sources say the malware reads a Solana blockchain transaction to learn where to fetch the piece, with a Google Calendar entry as a backup. A blockchain record cannot be taken down like a normal server, which makes the control channel hard to cut.

5 What we could not confirm We did not install any extension, did not read the code ourselves and found no Microsoft Defender detection name for GlassWorm in the sources we read. We also cannot tell you which extensions are affected today: the lists in the reports are from 2025 and 2026 and have since been removed from the registries.

What we could not confirm

We did not install any extension, did not read the code ourselves and found no Microsoft Defender detection name for GlassWorm in the sources we read. We also cannot tell you which extensions are affected today: the lists in the reports are from 2025 and 2026 and have since been removed from the registries.

What GlassWorm (VS Code extension worm and stealer) does on an infected PC

What we checked on 23 October 2026, and what we could not

GlassWorm is a name, not an address, so there was nothing for our server to request. Our check was reading the research and looking at the abuse.ch ThreatFox listing that brought the name to us.

Our check, 23 October 2026

Site test Not possible. The subject is a malware name, so no plain request was made and there is no screenshot.

ThreatFox listing One entry with the malware name GlassWorm, last seen 21 October 2026. We do not know which indicator it carries.

Vendor research Veracode, Koi, the Eclipse Foundation and BleepingComputer all describe real malicious extensions that stole credentials and wallet data.

Microsoft detection name We looked and found none for GlassWorm. That is a gap in what we found, not a sign that Defender is silent.

Current extension list Not known. Affected extensions were removed from the registries after they were reported, and new ones have appeared in later waves.

Dangerous if an affected extension ran on your machine The rating comes from the published research, not from a test of ours. If you only read the name, you are not infected by that.

GlassWorm from October 2025 to today

The story is a series of waves rather than one event. The dates below come from the sources we read; the counts are the researchers' estimates.

17 October 2025 Seven Open VSX extensions are compromised Reports date the first compromise of seven Open VSX extensions to this day. Koi Security found it a few days later and documented it on or 20 October.

Seven Open VSX extensions are compromised

Reports date the first compromise of seven Open VSX extensions to this day. Koi Security found it a few days later and documented it on or 20 October.

20 October 2025 One extension reaches Microsoft's marketplace Dark Reading and others report that an infected extension also appeared on the Microsoft VS Code marketplace and that Microsoft removed it once Koi reported it.

20 October 2025

One extension reaches Microsoft's marketplace

Dark Reading and others report that an infected extension also appeared on the Microsoft VS Code marketplace and that Microsoft removed it once Koi reported it.

21 October 2025 Open VSX calls the incident closed The Eclipse Foundation's Open VSX team published a security update. It says leaked tokens came from developer mistakes, not from a break into the registry, that all affected tokens were revoked and that it removed the extensions Koi flagged.

Open VSX calls the incident closed

The Eclipse Foundation's Open VSX team published a security update. It says leaked tokens came from developer mistakes, not from a break into the registry, that all affected tokens were revoked and that it removed the extensions Koi flagged.

6 November 2025 A new wave of three extensions Koi reported three more malicious Open VSX extensions and estimated roughly 10,000 additional infections. The Open VSX team's earlier statement of containment did not last.

A new wave of three extensions

Koi reported three more malicious Open VSX extensions and estimated roughly 10,000 additional infections. The Open VSX team's earlier statement of containment did not last.

Later in 2025 and 2026 Wider waves BleepingComputer reported a wave that targets Macs with trojanized crypto wallet apps, and another that touched more than 400 code repositories across GitHub, npm, VS Code and Open VSX. A third wave of 24 new packages was also reported. Numbering differs by outlet.

Later in 2025 and 2026

BleepingComputer reported a wave that targets Macs with trojanized crypto wallet apps, and another that touched more than 400 code repositories across GitHub, npm, VS Code and Open VSX. A third wave of 24 new packages was also reported. Numbering differs by outlet.

21 October 2026 ThreatFox lists the name abuse.ch ThreatFox shows one entry under the malware name GlassWorm. This is the entry that put the name on our radar. What it contains is not visible in our data.

ThreatFox lists the name

abuse.ch ThreatFox shows one entry under the malware name GlassWorm. This is the entry that put the name on our radar. What it contains is not visible in our data.

What the pattern suggests, and what it does not: every time a registry cleaned up, the same kind of attack came back in another form. That is our reading of the dates. No source we read says when it will stop.

How a poisoned extension works, step by step

Code editor extensions run with the same rights as you. They can read your files, your saved logins and your environment variables, and they start whenever the editor does. That trust is what GlassWorm uses.

1 The extension looks normal In the reports the extensions either were genuine ones that an attacker took over with a stolen publishing token, or look alike copies of popular ones. Both do what their description says, which keeps ratings and install counts healthy.

The extension looks normal

In the reports the extensions either were genuine ones that an attacker took over with a stolen publishing token, or look alike copies of popular ones. Both do what their description says, which keeps ratings and install counts healthy.

2 A hidden decoder runs on start The invisible characters hide a payload inside a plain looking string. When VS Code or a compatible editor starts the extension, a few visible lines decode the hidden characters and run the result. Veracode points to this as the reason static checks and manual reading miss it.

A hidden decoder runs on start

The invisible characters hide a payload inside a plain looking string. When VS Code or a compatible editor starts the extension, a few visible lines decode the hidden characters and run the result. Veracode points to this as the reason static checks and manual reading miss it.

3 It asks the blockchain, not a server Instead of a fixed address, the code looks up a Solana transaction that holds a link to the stage. The attackers can change the link by writing a new transaction. Google Calendar served as a backup channel.

It asks the blockchain, not a server

Instead of a fixed address, the code looks up a Solana transaction that holds a link to the stage. The attackers can change the link by writing a new transaction. Google Calendar served as a backup channel.

4 A stealer and a remote access tool arrive The later stages collect credentials and wallet data, and sources describe a SOCKS proxy and a hidden VNC style remote desktop (called HVNC) that lets a person use the machine without showing a window. Veracode names the final payload ZOMBI.

A stealer and a remote access tool arrive

The later stages collect credentials and wallet data, and sources describe a SOCKS proxy and a hidden VNC style remote desktop (called HVNC) that lets a person use the machine without showing a window. Veracode names the final payload ZOMBI.

5 The stolen tokens feed the round GitHub, npm and Open VSX tokens found on the machine can be used to publish new versions of the developer's own extensions and packages, with the hidden code added. That is the loop that earned the name worm.

The stolen tokens feed the round

GitHub, npm and Open VSX tokens found on the machine can be used to publish new versions of the developer's own extensions and packages, with the hidden code added. That is the loop that earned the name worm.

What GlassWorm (VS Code extension worm and stealer) can steal or download

What GlassWorm is reported to take

Different waves took different things. The list below is what at least one source names; no single report says every wave did all of it.

Wallet data from 49 crypto extensions

Browser data and saved logins

Cloud and CI/CD secrets

Hidden remote desktop access

A SOCKS proxy through your connection

What this can cost you

Reading GlassWorm costs nothing. The risks below apply to a machine where an affected extension actually ran.

High Crypto Wallet seed phrases and wallet files that were on the machine must be treated as known. Crypto sent from a stolen wallet cannot be reversed.

Wallet seed phrases and wallet files that were on the machine must be treated as known. Crypto sent from a stolen wallet cannot be reversed.

High Developer accounts and your own users A stolen GitHub, npm or Open VSX token lets someone publish under your name. If your packages are used by others, a poisoned release of your work reaches them.

Developer accounts and your own users

A stolen GitHub, npm or Open VSX token lets someone publish under your name. If your packages are used by others, a poisoned release of your work reaches them.

High Cloud and server access SSH keys and cloud or CI/CD secrets stored on a developer machine open the door to servers and build systems, not only to the machine itself.

Cloud and server access

SSH keys and cloud or CI/CD secrets stored on a developer machine open the door to servers and build systems, not only to the machine itself.

Medium Someone using the machine live A hidden remote desktop means the controller can act while you are logged in, and a proxy can send other people's traffic through your connection.

Someone using the machine live

A hidden remote desktop means the controller can act while you are logged in, and a proxy can send other people's traffic through your connection.

Medium Personal logins Browser saved passwords and session logins can be taken, which puts email, banking and social accounts at risk.

Browser saved passwords and session logins can be taken, which puts email, banking and social accounts at risk.

Low Nothing, if you only read the name A mention in a news item, a feed or a block list is not an infection.

Nothing, if you only read the name

A mention in a news item, a feed or a block list is not an infection.

What you may notice, and what you may not

The design goal is silence, and no source we read lists reliable symptoms. The signs below are our reading of how the malware works; most victims would notice nothing.

How to check the PC for GlassWorm (VS Code extension worm and stealer)

Who can meet GlassWorm, and who cannot

GlassWorm targets people who install editor extensions. If you never use Visual Studio Code, VSCodium, Cursor or another editor that uses these extension registries, the reports describe nothing that reaches you.

Check your machine before you delete anything

Start with one question: did you install, update or auto update a VS Code or Open VSX extension since October 2025, and did you keep wallets, tokens or keys on that machine? If yes or unsure, do the checks. None of them deletes anything.

While you check, avoid using the machine for banking, email, work accounts or crypto. If you can, take it offline. We built this order from the vendors' lists of what is stolen. We did not infect a machine to test it.

1 List your extensions In the editor open the Extensions view ( Ctrl+Shift+X on Windows and Linux, Cmd+Shift+X on a Mac). You can also run code --list-extensions --show-versions in a terminal. Write down every name and publisher. Look for any you did not choose.

In the editor open the Extensions view ( Ctrl+Shift+X on Windows and Linux, Cmd+Shift+X on a Mac). You can also run code --list-extensions --show-versions in a terminal. Write down every name and publisher. Look for any you did not choose.

2 Look at the publisher and the source For each unknown or unclear extension, open its page and read the publisher, the install count, the first release date and the repository link. A brand new publisher with an old looking name, or a repository that does not match, is worth treating as suspect.

Look at the publisher and the source

For each unknown or unclear extension, open its page and read the publisher, the install count, the first release date and the repository link. A brand new publisher with an old looking name, or a repository that does not match, is worth treating as suspect.

3 Check which registry you use Some editors use Open VSX, others use Microsoft's marketplace. The reports name both, so do not assume one is safe. Our reading is that the registry is not the protection; the individual extension is the risk.

Check which registry you use

Some editors use Open VSX, others use Microsoft's marketplace. The reports name both, so do not assume one is safe. Our reading is that the registry is not the protection; the individual extension is the risk.

4 Check startup entries On Windows open Settings > Apps > Startup and Task Scheduler for entries you did not make. On a Mac look in ~/Library/LaunchAgents and /Library/LaunchAgents for unknown items, since BleepingComputer names a LaunchAgent in the Mac wave. An unknown entry is a reason to look closer, not proof.

Check startup entries

On Windows open Settings > Apps > Startup and Task Scheduler for entries you did not make. On a Mac look in ~/Library/LaunchAgents and /Library/LaunchAgents for unknown items, since BleepingComputer names a LaunchAgent in the Mac wave. An unknown entry is a reason to look closer, not proof.

5 Check your security software On Windows, open Windows Security > Virus & threat protection > Protection history and look for anything blocked or quarantined around an extension update. We found no Microsoft detection name for GlassWorm, so a clean history clears nothing.

Check your security software

On Windows, open Windows Security > Virus & threat protection > Protection history and look for anything blocked or quarantined around an extension update. We found no Microsoft detection name for GlassWorm, so a clean history clears nothing.

6 Check your accounts from another device Look at the security log of GitHub, npm and your cloud provider for sign ins or token use you do not recognise, and check recent releases of anything you publish. This is quicker than any file check and tells you if tokens were used.

Check your accounts from another device

Look at the security log of GitHub, npm and your cloud provider for sign ins or token use you do not recognise, and check recent releases of anything you publish. This is quicker than any file check and tells you if tokens were used.

7 A scan helps, but it does not clear the machine Run a full scan with your security product. Treat a clean result as one data point. If you cannot rule out that an affected extension ran, rely on the clean up below, not on the scan.

A scan helps, but it does not clear the machine

Run a full scan with your security product. Treat a clean result as one data point. If you cannot rule out that an affected extension ran, rely on the clean up below, not on the scan.

How to remove GlassWorm (VS Code extension worm and stealer)

How to remove GlassWorm

A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.

1 Step 1 : Delete scheduled tasks that bring it back Programs like GlassWorm add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler , open Task Scheduler Library and sort by Last Run Time to see what ran recently. On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete . Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 1 : Delete scheduled tasks that bring it back

Programs like GlassWorm add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler , open Task Scheduler Library and sort by Last Run Time to see what ran recently.

On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete .

Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.

Full procedure with screenshots: Remove what malware leaves behind in Windows

2 Step 2 : Remove it from startup Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component. Right-click an entry and choose Open file location to see where it runs from: programs in %AppData% or %Temp% deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check. Full procedure with screenshots: Stop apps from opening at startup On uGetFix

Step 2 : Remove it from startup

Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.

Right-click an entry and choose Open file location to see where it runs from: programs in %AppData% or %Temp% deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.

Full procedure with screenshots: Stop apps from opening at startup On uGetFix

3 Step 3 : Delete the folders left behind Uninstalling often leaves the program's folders, and some threats reinstall themselves from them. Press Windows + R , type %LocalAppData% and press Enter, then do the same for %AppData% and %ProgramData%, and look for folders named after GlassWorm, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too. If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 3 : Delete the folders left behind

Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.

Press Windows + R , type %LocalAppData% and press Enter, then do the same for %AppData% and %ProgramData%, and look for folders named after GlassWorm, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.

If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.

Full procedure with screenshots: Remove what malware leaves behind in Windows

4 Step 4 : Scan the PC, then run the offline scan A scan finds the parts of GlassWorm that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options , start a Full scan and quarantine what it reports. Follow it with Microsoft Defender Antivirus (offline scan) > Scan now , which restarts the PC and checks the disk while Windows and the malware are not running. It takes 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean. Full procedure with screenshots: Run a Microsoft Defender Offline scan

Step 4 : Scan the PC, then run the offline scan

A scan finds the parts of GlassWorm that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options , start a Full scan and quarantine what it reports.

Follow it with Microsoft Defender Antivirus (offline scan) > Scan now , which restarts the PC and checks the disk while Windows and the malware are not running.

It takes 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.

Full procedure with screenshots: Run a Microsoft Defender Offline scan

5 Step 5 : Change passwords from another device and sign out other sessions GlassWorm can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft. Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules. Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean. Full procedure with screenshots: Turn on two-step verification / secure a hacked account

Step 5 : Change passwords from another device and sign out other sessions

GlassWorm can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.

Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.

Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.

Full procedure with screenshots: Turn on two-step verification / secure a hacked account

If you only use a Mac, an iPhone or an Android phone

The sources describe desktop code editors. A Mac that runs VS Code can meet GlassWorm; a phone without such an editor cannot.

After removal: passwords, accounts and prevention

If an affected extension ran: protect what was taken

The machine is only half of it. The other half is every login, token, key and wallet that was on it. The order matters: another device first, the machine second.

1 Move crypto first If a seed phrase or wallet file was ever on the machine, assume it is known. Create a new wallet and recovery phrase on a clean device and move the funds there before anything else. Also replace wallet apps that were installed from an unclear source, because the Mac wave swapped in fake Ledger Live and Trezor Suite.

If a seed phrase or wallet file was ever on the machine, assume it is known. Create a new wallet and recovery phrase on a clean device and move the funds there before anything else. Also replace wallet apps that were installed from an unclear source, because the Mac wave swapped in fake Ledger Live and Trezor Suite.

2 Change passwords from a clean device Start with email, because it resets everything else, then GitHub, cloud accounts, banking and exchanges. Anything typed on the machine while the malware was there may be known, so changing passwords on that machine does not help.

Change passwords from a clean device

Start with email, because it resets everything else, then GitHub, cloud accounts, banking and exchanges. Anything typed on the machine while the malware was there may be known, so changing passwords on that machine does not help.

3 Revoke and reissue tokens and keys Revoke GitHub personal access tokens, npm tokens and Open VSX tokens, then create new ones. Rotate SSH keys and any cloud or CI/CD secrets that were stored on the machine. Sign out of other sessions and turn on two step sign in where it is offered.

Revoke and reissue tokens and keys

Revoke GitHub personal access tokens, npm tokens and Open VSX tokens, then create new ones. Rotate SSH keys and any cloud or CI/CD secrets that were stored on the machine. Sign out of other sessions and turn on two step sign in where it is offered.

4 Review what you publish Check the version history of your own extensions and packages for releases you did not make, and ask the registry to pull any that look wrong. If your work is used by others, tell its users. Eclipse's own advice was to rotate tokens, and this is the same idea.

Review what you publish

Check the version history of your own extensions and packages for releases you did not make, and ask the registry to pull any that look wrong. If your work is used by others, tell its users. Eclipse's own advice was to rotate tokens, and this is the same idea.

5 Remove the extension In the Extensions view, open the gear of the extension and choose Uninstall , then restart the editor. Uninstalling stops it running again, but it does not undo what was already taken and it may not remove anything else that a later stage installed.

In the Extensions view, open the gear of the extension and choose Uninstall , then restart the editor. Uninstalling stops it running again, but it does not undo what was already taken and it may not remove anything else that a later stage installed.

6 Remove startup entries you can tie to it If you found an unknown LaunchAgent or a startup entry that appeared at the same time, remove it. If you cannot tell what it belongs to, do not guess; use the wipe below.

Remove startup entries you can tie to it

If you found an unknown LaunchAgent or a startup entry that appeared at the same time, remove it. If you cannot tell what it belongs to, do not guess; use the wipe below.

7 If you are not sure, wipe and reinstall A full reinstall of the operating system is the answer that does not depend on finding every piece. On Windows the path is Settings > System > Recovery > Reset this PC with Remove everything . On a Mac use macOS Recovery to erase and reinstall. Back up your own files first and restore only documents and source code, not programs or extension settings.

If you are not sure, wipe and reinstall

A full reinstall of the operating system is the answer that does not depend on finding every piece. On Windows the path is Settings > System > Recovery > Reset this PC with Remove everything . On a Mac use macOS Recovery to erase and reinstall. Back up your own files first and restore only documents and source code, not programs or extension settings.

8 Watch your accounts for weeks Turn on alerts for sign ins and token use, and check statements and exchange logs. If your personal information was taken, the FTC lists steps at IdentityTheft.gov.

Watch your accounts for weeks

Turn on alerts for sign ins and token use, and check statements and exchange logs. If your personal information was taken, the FTC lists steps at IdentityTheft.gov.

Keep an editor out of this kind of attack

No single step stops a poisoned extension that looks genuine, because the invisible code defeats reading it. The useful steps are to install less, keep secrets away from the editor machine, and be able to rotate tokens quickly.

Install only the extensions you really use, and remove the rest once a quarter.

Check the publisher, first release date and repository of an extension before you install it.

Turn off automatic extension updates on machines that hold wallets, tokens or keys, and update on purpose.

Keep crypto wallets, seed phrases and long lived tokens off the machine you use for code.

Use short lived tokens with the smallest rights, and keep a note of where each one is used so you can revoke it fast.

Keep an offline backup of your own files.

Do not trust an extension because it has many installs or good ratings; the reports show affected ones kept both.

Do not store a seed phrase in a notes file or a project folder.

Do not reuse one token for several tools.

Do not change passwords on the machine you suspect.

Do not rely on a quiet scan to say that you are safe.

Questions GlassWorm (VS Code extension worm and stealer)

GlassWorm is the name researchers gave to a malware campaign that hides in extensions for Visual Studio Code and for editors that use the Open VSX registry. Koi Security documented it in October 2025. The code runs when the editor starts, steals developer tokens, saved logins and crypto wallet data, and can give a stranger hidden remote access.

It is called a worm because stolen publishing tokens are used to poison more extensions, although the Eclipse Foundation disputes that it spreads by itself. It is not a single file that you download on purpose.

Is GlassWorm a virus?

It is better called a stealer and remote access tool delivered through a supply chain attack, and it is a real threat, not a hoax. A classic virus copies itself into files on your computer.

GlassWorm instead arrives inside an editor extension that you install, runs when the editor starts, and reuses stolen tokens to reach other extensions and packages. Veracode, Koi and BleepingComputer all describe real malicious extensions. If you never use VS Code or a compatible editor, nothing we read says it reaches you.

How do I know if I have GlassWorm?

We cannot give a reliable test, and no source we read lists one. Open the Extensions view in your editor, or run code --list-extensions --show-versions, and look for extensions you did not choose or that changed publisher.

Check the sign in logs of GitHub, npm and your cloud accounts for activity you do not recognise, and on a Mac look for unknown LaunchAgents. A clean scan does not clear you, because we found no Microsoft detection name. If you are unsure, treat the machine as exposed and follow the clean up steps.

How do I remove GlassWorm?

Do the account work first, from another device: move crypto to a new wallet, change passwords, revoke GitHub, npm and Open VSX tokens, and rotate SSH and cloud keys. Then uninstall the extension from the Extensions view and restart the editor, check startup entries, and run a full scan.

Uninstalling does not undo what was taken. If you cannot rule out that something else was installed, wipe the machine and reinstall, then restore only your own documents and code. We followed vendor descriptions and did not test this on an infected machine.

What does GlassWorm steal?

Reports name GitHub, npm and Open VSX credentials, data from 49 crypto wallet extensions in the first wave, and in a later Mac wave browser data, the keychain, SSH keys and cloud or CI/CD secrets.

Veracode also describes a SOCKS proxy and a hidden VNC style remote desktop. Not every wave did all of it. The practical advice is to treat every token, key, saved login and wallet on the machine as known and to replace them from a clean device.

Does GlassWorm affect Mac, Linux or Windows?

The reports describe developer computers in general, and BleepingComputer describes a later wave aimed at Macs, with a LaunchAgent for persistence and fake copies of the Ledger Live and Trezor Suite wallet apps.

The editor extension model works on Windows, macOS and Linux, so any of them can run an affected extension. We found no source that describes GlassWorm on an iPhone or an Android phone, so on a phone without such an editor there is nothing to remove.

Were Open VSX and the VS Code marketplace hacked?

The Eclipse Foundation says its Open VSX registry was not broken into: leaked tokens came from developer mistakes, affected tokens were revoked and the flagged extensions were removed. It also disputes that the malware spread without stolen credentials.

Reports say one infected extension also reached Microsoft's marketplace and was removed after Koi reported it. Later waves showed that cleaning up once did not end it, because new extensions and new stolen tokens kept appearing. The safest view is that no registry is a guarantee.

How can I protect myself from malicious VS Code extensions?

Install fewer extensions, and check the publisher, the first release date and the repository before you add one. Turn off automatic updates on machines that hold wallets, tokens or keys, and update on purpose.

Keep crypto and long lived tokens off your code machine, use short lived tokens with small rights, and keep a list of where each is used so you can revoke it quickly. Invisible characters defeat code review, so these habits matter more than reading the code.

I only saw GlassWorm in a security feed. Am I affected?

Not by that alone. A name in a feed such as abuse.ch ThreatFox, a news article or a block list is not an infection. ThreatFox shows one entry under this name, seen on 21 October 2026, and we do not know what it points to.

You are only in question if you installed or updated an editor extension that was affected and kept secrets on that machine. If you are in that group, follow the checks on this page; if not, no action is needed for this threat.

Will Fortect remove GlassWorm?

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For GlassWorm, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.

Veracode: GlassWorm, the first self-propagating VS Code extension worm ( read October 23, 2026 )

Eclipse Foundation, Open VSX security update, October 2025 ( read October 23, 2026 )

Koi Security: GlassWorm returns, new wave of Open VSX malware exposes attacker infrastructure ( read October 23, 2026 )

BleepingComputer: New GlassWorm malware wave targets Macs with trojanized crypto wallets ( read October 23, 2026 )

BleepingComputer: GlassWorm malware hits 400 plus code repos on GitHub, npm, VS Code and OpenVSX ( read October 23, 2026 )