[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJnH6LqNSqDr-aH5StbaOJYlAz30VEsuCt4MS4G4z1ro":3},{"article":4,"iocs":55,"watch_terms":67,"solutions":68,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":34,"category":35,"article_tags":39},"4e3b12d9-22ce-49b0-8b6b-7e5b7c6207ee","GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs","glassworm-campaign-uses-zig-dropper-to-infect-multiple-developer-ides-31e66c","Cybersecurity researchers have flagged yet another evolution of the ongoing GlassWorm campaign, which employs a new Zig dropper that's designed to stealthily infect all integrated development environments (IDEs) on a developer's machine. The technique has been discovered in an Open VSX extension named \"specstudio.code-wakatime-activity-tracker,\" which masquerades as WakaTime, a","Cybersecurity researchers discovered a new evolution of the GlassWorm campaign using a Zig-compiled dropper embedded in a fake WakaTime VS Code extension on Open VSX. The dropper identifies all IDEs on a developer's system and silently installs a malicious second-stage extension that communicates via Solana blockchain to fetch C2 commands, exfiltrate data, and deploy information-stealing malware. Affected users of the extensions \"specstudio.code-wakatime-activity-tracker\" and \"floktokbok.autoimport\" are advised to assume compromise and rotate all secrets.","GlassWorm campaign deploys Zig dropper via malicious VS Code extension to infect multiple developer IDEs.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F04\u002Fglassworm-campaign-uses-zig-dropper-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEioOU2XpKmyRPz5kTr4GhD1YLJ2t7F6yv7bQD1upkiwmGwmzirnDAz92GvtjckyoBhBjaRqeR9XPm6e0yHdKLowfDDgZNkRlCvCneJEncgiviFu7PgD4wQg3Bo5JDhgg6JTytg_fY2M-iKeykCLebOdStW4A76JKnPbEQazihNOhKOdM9Ou8keMBh4IY4jo\u002Fs1600\u002Fsoftware.jpg","2026-04-10T13:23:00+00:00","2026-04-10T16:00:22.575437+00:00",9,[17,20,23,26,29,31],{"name":18,"type":19},"GlassWorm","threat_actor",{"name":21,"type":22},"GlassWorm Campaign","campaign",{"name":24,"type":25},"VS Code","product",{"name":27,"type":28},"Microsoft","vendor",{"name":30,"type":25},"Open VSX",{"name":32,"type":33},"Solana blockchain","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":34,"icon":36,"name":37,"slug":38},null,"Malware","malware",[40,45,50],{"category":41},{"id":42,"icon":36,"name":43,"slug":44},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":46},{"id":47,"icon":36,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":51},{"id":52,"icon":36,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,58,61,64],{"type":38,"value":18,"context":57},"Ongoing campaign using Zig dropper to infect multiple IDEs",{"type":38,"value":59,"context":60},"win.node \u002F mac.node","Zig-compiled Node.js native addons that find and infect all IDEs on system",{"type":38,"value":62,"context":63},"floktokbok.autoimport","Second-stage malicious VS Code extension impersonating legitimate steoates.autoimport; acts as dropper and RAT installer",{"type":38,"value":65,"context":66},"specstudio.code-wakatime-activity-tracker","Malicious Open VSX extension masquerading as WakaTime that delivers Zig dropper",[27,24,30],{"controls":69,"vendors":144},[70,90,119],{"slug":71,"name":72,"problem":73,"products":74},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[75,82],{"vendor_slug":76,"vendor_name":27,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":91,"name":92,"problem":93,"products":94},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":120,"name":121,"problem":122,"products":123},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[124,131,138],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":120,"product_name":128,"url":129,"description":130},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":132,"product_name":135,"url":136,"description":137},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":139,"product_name":140,"url":142,"description":143},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[145],{"slug":76,"name":27,"logo_path":77,"roles":146},[147],"affected",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":158},"malicious-ide-extensions-compromise-developer-systems-via-supply-chain-attack","Malicious IDE Extensions Compromise Developer Systems via Supply Chain Attack","The GlassWorm campaign demonstrates how attackers can compromise developer environments by distributing malicious extensions through legitimate marketplaces like Open VSX. The fake WakaTime extension used a sophisticated Zig-compiled dropper to identify and infect multiple IDEs on developers' systems, then established persistent communication through Solana blockchain infrastructure. This supply chain attack is particularly dangerous because developers typically have elevated access to sensitive code repositories, credentials, and production systems. The use of blockchain for command and control makes detection and takedown significantly more challenging than traditional C2 infrastructure.",[153,154,155,156,157],"CIS Control 2.1","CIS Control 16.2","NIST SP 800-161","NIST SC-30","OWASP Top 10 A06:2021",{}]