GlassWorm Campaign Targets Developers with Malicious VS Code Extensions

• •Malicious VS Code extensions linked to GlassWorm have over 8,000 installs.
• •Extensions use obfuscated JavaScript loaders to fetch additional payloads.
• •Organizations should review and monitor installed extensions for security.

A cluster of malicious Visual Studio Code extensions linked to the GlassWorm threat actor was uncovered, affecting thousands of developers. These extensions, disguised as color themes, contain obfuscated JavaScript loaders that can retrieve secondary payloads. The Socket Threat Research team identified two confirmed malicious extensions and several high-risk, cluster-linked identities through Git history analysis. The malicious extensions, including Coca-Cola Christmas and Aurora Borealis Studio Theme, have accumulated over 8,000 installs on the Visual Studio Marketplace. The malware uses techniques such as AES-256-CBC decryption and Solana blockchain transaction memos to communicate with command and control infrastructure. Organizations are advised to review their installed extensions, particularly those from the Visual Studio Marketplace and Open VSX. Immediate isolation of affected hosts is recommended if malicious activity is detected. The campaign exploits the software supply chain to target developers and steal sensitive data.