{“lastseen”:”2026-04-27T11:28:35″,”description”:”\\n\\nCybersecurity researchers have flagged dozens of Microsoft Visual Studio Code (VS Code) extensions on the Open VSX repository that are linked to a persistent information-stealing campaign dubbed **GlassWorm**.\\n\\nThe cluster of 73 extensions has been identified as cloned versions of their legitimate counterparts. Of these, six have been confirmed to be malicious, with the remaining acting as seemingly harmless sleeper packages to get users to download them and build trust, before their true intent is manifested through a subsequent update.\\n\\nAll the extensions were published at the start of the month, per application security company Socket, which is tracking the latest iteration under the moniker GlassWorm v2. In total, more than 320 artifacts have been identified since December 21, 2025. The list of extensions identified as malicious is listed below -\\n\\n * outsidestormcommand.monochromator-theme\\n * keyacrosslaud.auto-loop-for-antigravity\\n * krundoven.ironplc-fast-hub\\n * boulderzitunnel.vscode-buddies\\n * cubedivervolt.html-code-validate\\n * winnerdomain17.version-lens-tool\\n\\n\\n\\nThe cloned sleepers, besides typosquatting the names of the original packages (CEINTL.vscode-language-pack-tr vs. Emotionkyoseparate.turkish-language-pack), use the same icon and description as their corresponding legitimate versions in an attempt to fool unsuspecting developers and trick them into installing the extensions.\\n\\nThis \\”visual trust\\” acts as an effective social engineering tactic to boost install counts organically before it’s poisoned to serve malware to the downstream users.\\n\\nThe disclosure comes as the threat actors behind the campaign are actively evolving their modus operandi, pivoting to sleeper packages and transitive dependencies to evade detection, while simultaneously using Zig-based droppers to deploy a secondary VSIX extension hosted on GitHub that can infect all integrated development environments (IDEs) on a developer’s machine.\\n\\nThe extensions identified by Socket act as an innocuous loader for the actual payload, which is a VSIX extension that’s retrieved from GitHub and installed into every IDE identified in the system, including VS Code, Cursor, Windsurf, and VSCodium, using the \\”–install-extension\\” command.\\n\\nIrrespective of the method used, the end goal is the same: run malware that avoids Russian systems, steal sensitive data, install a remote access trojan (RAT), and stealthily deploy a rogue Chromium-based extension to siphon credentials, bookmarks, and other information.\\n\\n\\”This approach achieves the same outcome as the binary-based variant, but keeps the delivery logic in obfuscated JavaScript,\\” the company said. \\”The extension acts as a loader, while the payload is retrieved and executed after activation.\\”\\n\\nFound this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.\\n”,”published”:”2026-04-27T11:23:00″,”modified”:”2026-04-27T11:23:56″,”type”:”thn”,”title”:”Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware”,”source”:””,”references”:””,”id”:”THN:88F8DC9CE169FAE883B6C338DE63F831″,”bulletinFamily”:”info”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/thehackernews.com\/2026\/04\/researchers-uncover-73-fake-vs-code.html”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-27T11:28:35″,”description”:”\\n\\nCybersecurity researchers have flagged dozens of Microsoft Visual Studio Code (VS Code) extensions on the Open VSX repository that are linked to a persistent information-stealing…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,13,33,7,11,43,5],"class_list":["post-49507","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-security","tag-tapic","tag-thn","tag-vulnerability"],"yoast_head":"\n