GlassWorm Malware Turns VS Code Extensions into an Attack Vector Against macOS
GlassWorm, a self-propagating malware, has evolved and now targets macOS. Initially identified in October via VS Code extensions, it now has 50,000 downloads and a fully functional infrastructure.
GlassWorm, a self-propagating malware, has evolved and now targets macOS. Initially identified in October via VS Code extensions, it now has 50,000 downloads and a fully functional infrastructure.
Security experts have pinpointed three malicious extensions in the Open VSX marketplace linked to the actor by shared command-and-control infrastructure, specifically the IP address 45.32.151.157.
This development marks a significant escalation, utilizing AES-256-CBC encrypted payloads in compiled JavaScript rather than previous Unicode obfuscation techniques. The encryption employs a hardcoded key shared across the malicious extensions, indicating a single coordinated threat actor.
The malware includes a 15-minute execution delay to evade automated sandbox environments that timeout after five minutes, effectively bypassing initial security scans upon installation.
The latest wave targets macOS, diverging from previous Windows-only attacks. This shift is strategic, as many developers in cryptocurrency and startup ecosystems use Apple devices. The macOS payload uses AppleScript for execution, LaunchAgents for persistence, and directly targets the Keychain database.
GlassWorm, a self-propagating malware, has evolved and now targets macOS.
GlassWorm's command-and-control infrastructure continues to evolve. A new Solana wallet address (BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC) has been deployed, supplementing existing wallets. The blockchain-based C2 mechanism uses Solana transaction memos with base64-encoded URLs to update C2 endpoints, making them decentralized and resistant to takedown.
Infrastructure monitoring shows changes between IP addresses 217.69.11.60 and 45.32.151.157, with a new exfiltration server at 45.32.150.251.
The malware's most concerning new capability is targeting hardware wallets like Ledger Live and Trezor Suite by replacing legitimate software with compromised versions.
If successful, this attack could display fake addresses, alter transaction details, capture seed phrases, and intercept device communications, compromising hardware wallet security. The C2 endpoints for these payloads currently return empty files, suggesting preparation stages are ongoing as of Thu, Dec 29, 2025.
GlassWorm includes file-size validation, preventing installations smaller than 1000 bytes, reflecting sophisticated development practices. The malware continues to adapt and evolve in response to security research, maintaining an active and operational threat.
Based on reporting by GBHackers.