Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware

Back Thehackernews

Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware

Thehackernews •[email protected] (The Hacker News) • April 27, 2026

Share: View original

Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points.

Learn how to validate real attack paths and reduce exploitable risk with continuous agentic security validation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GlassWorm Malware Campaign Targets OpenVSX with 73 Malicious Extensions A resurgence of the GlassWorm malware campaign has been identified, targeting the OpenVSX ecosystem with 73 'sleeper' extensions that become malicious after updates. Six of these extensions have already been activated to deliver malware, while the remaining are suspected to be dormant. Initially benign, these extensions are designed to trick developers by mimicking legitimate ones, utilizing similar icons and descriptions. The campaign is a continuation of a supply chain attack strategy first observed in October 2025, which has previously affected various ecosystems, including GitHub and npm packages. The latest wave follows a significant attack in March 2026, which impacted hundreds of repositories. Researchers from Socket have recommended that developers who installed any of the affected extensions rotate their secrets and clean their environments. The full list of the 73 extensions has been published for awareness and mitigation. 7 sources 73

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

T1195 - Supply Chain Compromise

Tools (1)