Bleepingcomputer New GlassWorm Malware Targets macOS Developers with Trojanized Crypto Wallets
Article Content
Browse articles 
A fourth wave of the GlassWorm campaign is targeting macOS developers by distributing malicious VSCode/OpenVSX extensions that contain trojanized versions of crypto wallet applications. These extensions are available in the OpenVSX registry and the Microsoft Visual Studio Marketplace, which are used to enhance the functionality of VS Code-compatible editors.
Ask AI about this cluster
Answers cite the sources they use
Updated 226d ago How this analysis works
More articles in this cluster (7)
Following this threat?
Track Glassworm and Microsoft Visual Studio Marketplace in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Surge in Supply Chain Attacks: Axios Compromised In 2026, supply chain attacks surged, with notable incidents involving the axios package. Aikido Intel reported 19,500 malicious packages identified from 7.5 million analyzed, with attackers exploiting open source dependencies. In March 2026, attackers compromised the npm account of an axios maintainer, publishing two… 
GlassWorm Malware: First Self-Propagating Worm for VS Code Extensions In October 2025, Koi Security discovered GlassWorm, a self-propagating worm targeting Visual Studio Code extensions on OpenVSX and Microsoft marketplaces. The malware has compromised at least 35,800 installations, utilizing invisible code injection techniques to evade detection. GlassWorm operates by stealing NPM…