Glassworm Returns Once Again with a Third Round of VS Code Attacks

Why It Matters

The attacks compromise the security of millions of developers and crypto holders, exposing critical development tools to credential theft and remote control. This underscores the need for stronger marketplace vetting and developer vigilance.

Key Takeaways

• 24 malicious VS Code extensions deployed across marketplaces
• Extensions hide malware using invisible Unicode characters
• Payload installs Lumma stealer targeting developer credentials
• Attack adds HVNC client and SOCKS proxy
• Microsoft improving scans after being alerted by researchers

Pulse Analysis

The resurgence of the Glassworm campaign highlights a growing trend of supply‑chain attacks targeting developer ecosystems. By injecting malicious extensions into widely used repositories like Visual Studio Marketplace and OpenVSX, threat actors exploit the trust developers place in official tools. The use of invisible Unicode characters to mask payloads demonstrates a sophisticated evasion technique that can bypass traditional static analysis, allowing the Lumma stealer to silently harvest credentials from GitHub, npm, and other developer platforms.

Beyond credential theft, Glassworm’s payload includes a hidden HVNC (Hidden Virtual Network Computing) client and a SOCKS proxy, effectively turning compromised machines into footholds for lateral movement and data exfiltration. This dual‑function approach not only monetizes stolen tokens from browser‑extension wallets but also provides attackers with persistent remote access, increasing the potential impact on development pipelines, CI/CD environments, and downstream applications. The targeting of popular frameworks such as Flutter, Vue, and React Native expands the attack surface, putting a broad range of projects at risk.

Microsoft’s response—enhancing scanning algorithms and encouraging community reporting—reflects an industry‑wide shift toward collaborative defense. However, the incident serves as a reminder that developers must adopt a zero‑trust mindset: verify extension provenance, monitor permission requests, and employ endpoint protection that can detect anomalous behavior. As the marketplace model continues to dominate software distribution, robust vetting processes and real‑time threat intelligence will be essential to safeguard the integrity of the development stack.