Bleepingcomputer

GlassWorm Malware Resurfaces in Open VSX Extensions Following Token Leak

First seen 1 Dec 2025, 20:43 UTC • •30.3

Article Content

1 / 16

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

The Open VSX registry faced a supply chain attack after access tokens were leaked, allowing threat actors to publish malicious extensions. The GlassWorm malware campaign has returned with new extensions targeting developers' credentials and cryptocurrency wallets, leveraging obfuscation techniques to evade detection. Over 10,000 downloads of the new malicious extensions have been reported.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 218d ago How this analysis works

More articles in this cluster (15)

Threat Graph

14 entities, 16 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Data Breach
Malware
Supply Chain Attack

Campaign (2)

Glassworm Campaign
Glassworm Malware Campaign

Organization (3)

Open VSX
OpenVSX
Open VSX Registry

Malware (1)

Glassworm

Affected Platform (3)

GitHub
Solana
Visual Studio Code

Tool (2)

Npm
RedExt

Relationships

Glassworm Campaign uses Glassworm
Glassworm Malware Campaign uses Glassworm
Glassworm targets Open VSX
Glassworm targets OpenVSX
Glassworm targets Open VSX Registry
Data Breach targets GitHub
Data Breach targets Solana
Data Breach targets Visual Studio Code
Malware targets GitHub
Malware targets Solana
Malware targets Visual Studio Code
Supply Chain Attack targets GitHub
Supply Chain Attack targets Solana
Supply Chain Attack targets Visual Studio Code
Glassworm Campaign related to Npm
Glassworm Campaign related to RedExt

Following this threat?

Track Glassworm and Open VSX in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

GlassWorm Campaign Targets Developers with Malicious VS Code Extensions A cluster of malicious Visual Studio Code extensions linked to the GlassWorm threat actor was uncovered, affecting thousands of developers. These extensions, disguised as color themes, contain obfuscated JavaScript loaders that can retrieve secondary payloads. The Socket Threat Research team identified two confirmed…

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…