Do Son GlassWorm resurfaced, infecting 3 new VS Code extensions on OpenVSX. The worm uses invisible Unicode and Solana blockchain C2 to steal credentials and spread via AI-generated malicious commits on GitHub.
VSCode
HelixGuard exposed a VSCode supply chain attack using 12 malicious extensions. They steal source code, capture screenshots, and open reverse shells via Ngrok and AWS EC2 to compromise developers.
Koi Security exposed GlassWorm, the first VSCode worm that spreads autonomously, using invisible Unicode to hide malicious code. It uses Solana blockchain and Google Calendar for a resilient C2.
Wiz found 550+ secrets (PATs, API keys) leaked in 500+ VSCode extensions, enabling an attacker to push malicious updates to 100K+ developers. Dotfiles were the main culprit.
VSCode extension errors in Cursor? Learn why Microsoft's licensing restricts C/C++ & Remote SSH in non-Microsoft editors. Discover open-source alternatives
Discover the latest tactic employed by the Chinese APT group Stately Taurus. Learn how they abuse Visual Studio Code to gain unauthorized access to sensitive networks.