GlassWorm

Socket Links Popular VS Code Color Themes to the GlassWorm Supply Chain Campaign

• Malware

Socket Links Popular VS Code Color Themes to the GlassWorm Supply Chain Campaign

Do Son October 5, 2026 0

Socket links GlassWorm VS Code themes to malicious VS Code extensions with 8,000+ installs, including a Coca-Cola theme. See how to check yours.

GlassWASM Malware Hidden in Open VSX Extensions

• Malware

GlassWASM Malware Hidden in Open VSX Extensions

Do Son June 20, 2026 0

GlassWASM malware hides WebAssembly payloads in trojanized Open VSX extensions, abusing Solana memos for stealthy command-and-control.

The Sleeper in Your IDE: Unmasking the 73-Extension “GlassWorm” Espionage Campaign

• Malware

The Sleeper in Your IDE: Unmasking the 73-Extension “GlassWorm” Espionage Campaign

Do Son April 30, 2026 0

Socket uncovers GlassWorm: a 73-extension sleeper campaign on Open VSX targeting VS Code and Cursor. Stealthy .node binaries turn trusted tools into malware.

GlassWorm Abuses VS Code Extensions to Fuel Supply Chain Attacks

• Malware

GlassWorm Abuses VS Code Extensions to Fuel Supply Chain Attacks

Do Son March 17, 2026 0

Socket Research exposes how GlassWorm malware abuses Open VSX dependencies for transitive delivery of an RCE backdoor using Solana blockchain dead drops.

Open VSX Hijacked: “GlassWorm” Malware Poisons VS Code Extensions

• Malware

Open VSX Hijacked: “GlassWorm” Malware Poisons VS Code Extensions

Do Son February 5, 2026 0

GlassWorm malware found in Open VSX extensions. Hackers stole AWS & SSH keys from macOS devs using Solana C2. 22k+ downloads affected. Check your tools.

macOS Developers in the Crosshairs: GlassWorm’s Wave 4 Exploits VS Code to Trojanize Hardware Wallets

• Malware

macOS Developers in the Crosshairs: GlassWorm’s Wave 4 Exploits VS Code to Trojanize Hardware Wallets

Do Son January 6, 2026 0

GlassWorm Wave 4 targets macOS developers via VS Code, using encrypted payloads and a 15-minute fuse to trojanize Ledger and Trezor wallet apps.

GlassWorm Worm Resurfaces: Invisible Unicode Malware Re-Infects VS Code Extensions, Spreads to GitHub

• Malware

GlassWorm Worm Resurfaces: Invisible Unicode Malware Re-Infects VS Code Extensions, Spreads to GitHub

Do Son November 10, 2025 0

GlassWorm resurfaced, infecting 3 new VS Code extensions on OpenVSX. The worm uses invisible Unicode and Solana blockchain C2 to steal credentials and spread via AI-generated malicious commits on GitHub.

GlassWorm Supply Chain Worm Uses Invisible Unicode and Solana Blockchain for Stealth C2

• Malware

GlassWorm Supply Chain Worm Uses Invisible Unicode and Solana Blockchain for Stealth C2

Do Son October 20, 2025 0

Koi Security exposed GlassWorm, the first VSCode worm that spreads autonomously, using invisible Unicode to hide malicious code. It uses Solana blockchain and Google Calendar for a resilient C2.