MalwarePublished 28 Apr 2026

Dozens of Open VSX Extension Clones Linked to GlassWorm Malware

Source SecurityWeek

Description

Over 70 cloned extensions on the Open VSX marketplace have been identified as likely sleeper extensions linked to the GlassWorm malware. These extensions impersonate legitimate ones to gain user trust and are designed to deploy malware through future updates. GlassWorm malware steals credentials and sensitive information and uses sophisticated evasion techniques, including hiding code with Unicode variation selectors and leveraging blockchain-based command-and-control infrastructure. At least six of these cloned extensions have been activated. The threat actor uses multiple delivery mechanisms, including bundled native binaries and remote payload retrieval, to evade detection.

Impact

The GlassWorm-linked cloned extensions pose a risk of credential theft (GitHub, Git, NPM), sensitive data compromise, and cryptocurrency theft. By impersonating trusted extensions, they increase the likelihood of user installation and subsequent infection. The malware's use of multiple evasion and delivery techniques makes detection and prevention more challenging. At least six extensions have already been activated, indicating active exploitation potential. The threat affects users of the Open VSX extension marketplace and potentially other open source software ecosystems.

Defensive guidance

Users should avoid installing extensions from untrusted or newly created publishers, especially those with minimal GitHub activity or suspicious naming patterns. Monitoring for updates to installed extensions and verifying publisher authenticity can reduce risk. Security teams should be aware of the GlassWorm campaign's tactics and consider additional endpoint protections to detect unusual extension behavior.

Summary

In April 2026, security researchers identified over 70 cloned extensions on the Open VSX marketplace that are linked to the GlassWorm malware campaign. GlassWorm first appeared in October 2025 and targets GitHub, Git, and NPM credentials, as well as cryptocurrency. The cloned extensions mimic legitimate ones in appearance but are published by newly created GitHub accounts with minimal activity. These extensions initially appear benign but are designed as sleeper agents to deliver malware through updates. The malware employs obfuscation techniques such as Unicode variation selectors and uses the Solana blockchain for command-and-control. Delivery methods include bundled native binaries and remote payload downloads, complicating detection efforts.

References

securityweek.com/dozens-of-open-vsx-extension-clones-linked-to-glassworm-malware/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 28 Apr 2026, 12:51 UTC

References

Community reviews