Back Reddit

GlassWorm V2 Analysis

Reddit •/u/Willing_Monitor5855 • March 13, 2026

Static analysis and live infrastructure monitoring of a GlassWorm variant distributed through compromised Cursor extension on Open VSX. This writeup covers the infection chain, persistence mechanism, C2 architecture, an "interesting" kill switch, and ongoing operator activity observed over 57 hours of monitoring. C2 communication was designed to be particularly resilent to takedowns. submitted by /u/Willing_Monitor5855 [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Analysis of GlassWorm V2 Malware via Compromised Cursor Extension A variant of the GlassWorm malware has been identified, distributed through a compromised Cursor extension on Open VSX. The attack utilizes a sophisticated infection chain and a resilient command-and-control (C2) architecture designed to withstand takedowns. Over a 57-hour monitoring period, ongoing operator activity was observed, indicating active exploitation. The malware's persistence mechanism allows it to maintain control over infected systems. The exact number of affected users is currently unknown, but the implications for software supply chain security are significant. The presence of an 'interesting' kill switch suggests a level of sophistication in the malware's design. Security professionals are urged to monitor for signs of this variant in their environments. Further technical details, including specific indicators of compromise (IOCs), are pending publication. 2 sources 67

Extracted Entities

GlassWorm V2 Analysis

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Malware (1)

MITRE ATT&CK (1)

Tools (1)