Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware

Researchers discovered 73 fake VS Code extensions linked to GlassWorm v2 malware campaign delivering information-stealing payloads.

• •Six extensions confirmed malicious; remaining act as sleeper packages to build trust before weaponization
• •Attackers use typosquatting and visual cloning of legitimate extensions to trick developers into installation
• •Zig-based droppers retrieve VSIX payloads from GitHub to infect multiple IDEs including VS Code, Cursor, Windsurf, and VSCodium
• •JavaScript-obfuscated extension loaders steal credentials, install remote access trojans, and deploy rogue Chromium extensions for data harvesting

This summary was automatically generated by AI based on the original article and may not be fully accurate.