Threats Tagged 'dead-drop'

A malicious campaign involving Visual Studio Code extensions distributed via both the VS Code Marketplace and Open VSX registries has been identified. The campaign includes at least ten extensions, with two confirmed malicious themes that execute threat actor-controlled code and use sophisticated techniques such as encrypted JavaScript loaders, Russian-language gating, and Solana blockchain transaction memos for dynamic payload resolution. These extensions have been installed tens of thousands of times, posing a significant supply chain risk. Some extensions remain unweaponized but retain executable capabilities. The campaign is linked to the GlassWorm threat actor and employs brandjacking and infrastructure rotation tactics.