Cybersecurity analysts have identified a batch of fraudulent Microsoft Visual Studio Code extensions on the Open VSX marketplace, all connected to an ongoing data-theft operation known as GlassWorm.
The 73 flagged extensions are cloned copies of legitimate, well-known counterparts. While six have been confirmed to actively deliver malware, the rest appear to be dormant decoys — benign on the surface, designed to accumulate installs and establish credibility before being weaponized through a future update.
According to application security firm Socket, which is tracking this activity under the label GlassWorm v2, all of the extensions appeared on the marketplace at the start of April, and more than 320 total artifacts tied to the campaign have been detected since late December 2025.
The six extensions confirmed to be actively malicious are:
- outsidestormcommand.monochromator-theme
- keyacrosslaud.auto-loop-for-antigravity
- krundoven.ironplc-fast-hub
- boulderzitunnel.vscode-buddies
- cubedivervolt.html-code-validate
- winnerdomain17.version-lens-tool
The dormant clones use typosquatting to mimic the names of real packages, while copying the original icons and descriptions verbatim — a tactic designed to make them look indistinguishable from the genuine article. This visual mimicry functions as a social engineering strategy, driving organic installs before the extensions are later poisoned to target unsuspecting developers downstream.
The threat actors behind GlassWorm have been steadily refining their approach, shifting toward sleeper packages and transitive dependencies to avoid detection, while also employing Zig-based droppers to deliver a secondary malicious VSIX extension hosted on GitHub — one capable of infecting all IDEs present on a developer’s machine.
Once activated, the loader extension retrieves a payload from GitHub and installs it across every compatible IDE it finds on the system — including VS Code, Cursor, Windsurf, and VSCodium — using the “–install-extension” command.
Regardless of the specific delivery method used, the campaign’s objectives remain consistent: evade systems running in Russia, harvest sensitive data, install a remote access trojan, and silently deploy a rogue Chromium-based browser extension to steal credentials, bookmarks, and other personal information.
Socket noted that this JavaScript-based approach produces the same outcome as earlier binary-based variants, but keeps the malicious logic concealed within obfuscated code — making detection considerably harder.
Developers are advised to carefully vet extensions before installing them, even on repositories generally considered trustworthy, and to cross-reference publisher names and download counts against known-good sources.
Recent Comments