Executive Summary
In April 2026, cybersecurity researchers identified 73 malicious Visual Studio Code (VS Code) extensions on the Open VSX repository, linked to the GlassWorm v2 malware campaign. These extensions, cloned from legitimate ones, initially appeared benign but later delivered malware through updates. Six extensions were confirmed malicious, while others acted as sleeper agents to build trust before deploying harmful payloads. The attackers employed social engineering tactics, such as typosquatting and mimicking legitimate extension icons and descriptions, to deceive developers into installing these compromised extensions. The malware aimed to steal sensitive data, install remote access trojans, and deploy rogue browser extensions to siphon credentials and other information. This incident underscores the evolving nature of supply chain attacks targeting developer environments and the importance of vigilance when installing third-party extensions. The use of sleeper packages and transitive dependencies highlights the need for robust security measures and thorough vetting processes to prevent such infiltrations.
Why This Matters Now
The GlassWorm v2 campaign highlights the increasing sophistication of supply chain attacks targeting developer tools, emphasizing the urgent need for enhanced security practices and vigilance in the software development community.
Attack Path Analysis
Attackers compromised the Open VSX repository by publishing 73 malicious Visual Studio Code extensions, leading to the installation of GlassWorm v2 malware on developers' systems. The malware escalated privileges to gain deeper access, moved laterally across the network, established command and control channels, exfiltrated sensitive data, and caused significant operational impact.
Kill Chain Progression
Initial Compromise
Description
Attackers published 73 malicious Visual Studio Code extensions on the Open VSX repository, leading to the installation of GlassWorm v2 malware on developers' systems.
MITRE ATT&CK® Techniques
Compromise Software Supply Chain
Obtain Capabilities: Malware
Stage Capabilities
User Execution: Malicious File
Command and Scripting Interpreter: JavaScript
Process Injection
Screen Capture
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Applications and Workloads
Control ID: Pillar 3
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Direct exposure to GlassWorm v2 malware through compromised VS Code extensions targeting developers, enabling supply chain attacks and credential theft in software development environments.
Information Technology/IT
High risk from malicious VS Code extensions infiltrating development workflows, potentially compromising IT infrastructure through stolen credentials and lateral movement across enterprise networks.
Financial Services
Critical vulnerability as developers using infected extensions could expose sensitive financial data, violating PCI compliance requirements and enabling unauthorized access to banking systems.
Health Care / Life Sciences
Severe HIPAA compliance risks from compromised development tools potentially exposing patient data through infected VS Code extensions used in healthcare software development projects.
Sources
- Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malwarehttps://thehackernews.com/2026/04/researchers-uncover-73-fake-vs-code.htmlVerified
- GlassWorm v2 - Sockethttps://socket.dev/supply-chain-attacks/glassworm-v2Verified
- GlassWorm malware hides in invisible open-source codehttps://www.scientificamerican.com/article/glassworm-malware-hides-in-invisible-open-source-code/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could likely limit the malware's ability to escalate privileges, move laterally, establish command and control channels, and exfiltrate data, thereby reducing the attack's overall impact.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The initial compromise may not have been prevented by CNSF, as it focuses on post-compromise activities.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation could likely limit the malware's ability to escalate privileges by enforcing strict access controls and minimizing trust relationships.
Control: East-West Traffic Security
Mitigation: East-West Traffic Security would likely restrict the malware's lateral movement by monitoring and controlling internal traffic flows.
Control: Multicloud Visibility & Control
Mitigation: Multicloud Visibility & Control may detect and limit unauthorized command and control communications by providing comprehensive monitoring across cloud environments.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security & Policy Enforcement could likely limit data exfiltration by controlling and monitoring outbound traffic.
By constraining the malware's ability to escalate privileges, move laterally, establish command and control channels, and exfiltrate data, CNSF would likely reduce the overall operational impact of the attack.
Impact at a Glance
Affected Business Functions
- Software Development
- Integrated Development Environments (IDEs)
- Code Repositories
Estimated downtime: 7 days
Estimated loss: $50,000
Developer credentials, source code, and potentially sensitive project information.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement within the network.
- • Enhance East-West Traffic Security to monitor and control internal communications.
- • Deploy Egress Security & Policy Enforcement to prevent unauthorized data exfiltration.
- • Utilize Multicloud Visibility & Control to detect and respond to anomalous activities across cloud environments.
- • Apply Inline IPS (Suricata) to identify and block known exploit patterns and malicious payloads.
