GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs
GlassWorm campaign deploys Zig dropper via malicious VS Code extension to infect multiple developer IDEs.
Cybersecurity researchers discovered a new evolution of the GlassWorm campaign using a Zig-compiled dropper embedded in a fake WakaTime VS Code extension on Open VSX. The dropper identifies all IDEs on a developer's system and silently installs a malicious second-stage extension that communicates via Solana blockchain to fetch C2 commands, exfiltrate data, and deploy information-stealing malware. Affected users of the extensions "specstudio.code-wakatime-activity-tracker" and "floktokbok.autoimport" are advised to assume compromise and rotate all secrets.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe GlassWorm campaign demonstrates how attackers can compromise developer environments by distributing malicious extensions through legitimate marketplaces like Open VSX. The fake WakaTime extension used a sophisticated Zig-compiled dropper to identify and infect multiple IDEs on developers' systems, then established persistent communication through Solana blockchain infrastructure. This supply chain attack is particularly dangerous because developers typically have elevated access to sensitive code repositories, credentials, and production systems. The use of blockchain for command and control makes detection and takedown significantly more challenging than traditional C2 infrastructure.
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — GlassWorm
- malware — win.node / mac.node
- malware — floktokbok.autoimport
- malware — specstudio.code-wakatime-activity-tracker