{“lastseen”:”2026-04-10T13:56:33″,”description”:”\\n\\nCybersecurity researchers have flagged yet another evolution of the ongoing **GlassWorm** campaign, which employs a new Zig dropper that’s designed to stealthily infect all integrated development environments (IDEs) on a developer’s machine.\\n\\nThe technique has been discovered in an Open VSX extension named \\”specstudio.code-wakatime-activity-tracker,\\” which masquerades as WakaTime, a popular tool that measures the time programmers spend inside their IDE. The extension is no longer available for download.\\n\\n\\”The extension […] ships a Zig-compiled native binary alongside its JavaScript code,\\” Aikido Security researcher Ilyas Makari said in an analysis published this week.\\n\\n\\”This is not the first time GlassWorm has resorted to using native compiled code in extensions. However, rather than using the binary as the payload directly, it is used as a stealthy indirection for the known GlassWorm dropper, which now secretly infects all other IDEs it can find on your system.\\”\\n\\nThe newly identified Microsoft Visual Studio Code (VS Code) extension is a near replica of WakaTime, save for a change introduced in a function named \\”activate().\\” The extension installs a binary named \\”win.node\\” on Windows systems and \\”mac.node,\\” a universal Mach-O binary if the system is running Apple macOS.\\n\\nThese Node.js native addons are compiled shared libraries that are written in Zig and load directly into Node’s runtime and execute outside the JavaScript sandbox with full operating system-level access.\\n\\n\\n\\nOnce loaded, the primary goal of the binary is to find every IDE on the system that supports VS Code extensions. This includes Microsoft VS Code and VS Code Insiders, as well as forks like VSCodium, Positron, and a number of artificial intelligence (AI)-powered coding tools like Cursor and Windsurf.\\n\\nThe binary then downloads a malicious VS Code extension (.VSIX) from an attacker-controlled GitHub account. The extension \u2013 called \\”floktokbok.autoimport\\” \u2013 impersonates \\”steoates.autoimport,\\” a legitimate extension with more than 5 million installs on the official Visual Studio Marketplace.\\n\\nIn the final step, the downloaded .VSIX file is written to a temporary path and silently installed into every IDE using each editor’s CLI installer. The second-stage VS Code extension acts as a dropper that avoids execution on Russian systems, talks to the Solana blockchain to fetch the command-and-control (C2) server, exfiltrates sensitive data, and installs a remote access trojan (RAT), which ultimately deploys an information-stealing Google Chrome extension.\\n\\nUsers who have installed \\”specstudio.code-wakatime-activity-tracker\\” or \\”floktokbok.autoimport\\” are advised to assume compromise and rotate all secrets.\\n\\nFound this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.\\n”,”published”:”2026-04-10T13:23:00″,”modified”:”2026-04-10T13:23:17″,”type”:”thn”,”title”:”GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs”,”source”:””,”references”:””,”id”:”THN:70F63CFC6A8263F481353983FE4DD979″,”bulletinFamily”:”info”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/thehackernews.com\/2026\/04\/glassworm-campaign-uses-zig-dropper-to.html”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-10T13:56:33″,”description”:”\\n\\nCybersecurity researchers have flagged yet another evolution of the ongoing **GlassWorm** campaign, which employs a new Zig dropper that’s designed to stealthily infect all integrated…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,13,33,7,11,43,5],"class_list":["post-42676","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-security","tag-tapic","tag-thn","tag-vulnerability"],"yoast_head":"\n