GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs

The GlassWorm campaign uses a Zig dropper in a fake WakaTime VS Code extension to infect all developer IDEs on a machine.

• •The malicious extension contains a Zig-compiled native binary that runs with full OS-level access outside the JavaScript sandbox
• •The binary discovers and targets all IDE installations including VS Code, VSCodium, Positron, Cursor, and Windsurf
• •A second-stage malicious extension is downloaded and silently installed to every IDE via CLI
• •The extension communicates via Solana blockchain for command-and-control and deploys RAT and information-stealing tools
• •Users who installed either extension must assume compromise and rotate all secrets immediately

This summary was automatically generated by AI based on the original article and may not be fully accurate.