GlassWorm is turning developer tools into malware delivery channels, this time through extensions advertised as attractive VS Code themes.
The investigated cluster spans Visual Studio Marketplace and Open VSX, showing how appearance changes can provide cover for code that runs on developer machines. The campaign first surfaced in October 2025 and has since expanded across development platforms.
Earlier reporting on developer tools spreading GlassWorm describes credential theft and persistent access, risks that make compromised developer workstations valuable gateways into repositories, cloud environments, and other sensitive resources.
Researchers from Socket.dev identified four Marketplace extensions and six Open VSX identities linked to the theme cluster.
Socket.dev said in a report shared with Cyber Security News (CSN) that two extensions were confirmed malicious, with one showing a high-confidence technical connection to GlassWorm.
The findings distinguish confirmed malware from related extensions without active payloads. Coca-Cola Christmas and Aurora Borealis Studio Theme had more than 8,000 Marketplace installations combined.
Cluster-linked Open VSX listings attracted tens of thousands of downloads, although those totals do not establish how many users were compromised.
Aurora Nocturne Night Theme concealed a Windows downloader inside its distributed package, despite a public repository that appeared to provide theme functionality.
Its executable JavaScript was heavily disguised, compressed into roughly 59 KB on one line, and included a payload encoded with invisible Unicode characters.
After decoding the hidden instructions, the extension downloaded attacker-controlled content, saved a temporary Windows command script, and executed it without displaying a command window.
The discrepancy between public source code and the installed package explains why reviewing only a repository could miss the threat.
The disguise follows a pattern: earlier malicious icon theme extensions also combined normal visual behavior with concealed malware execution.
In the newly investigated cluster, familiar commercial branding and names copying themes helped suspicious packages appear credible before users checked their publishers.
Git histories connected several projects through shared contributors, while matching theme definitions, recurring Russian-language comments, and reused welcome-page code strengthened the development links.
Five commits on December 6, 2025, occurred within roughly three hours and used the same timezone offset. Socket also identified a December 14, 2025, article promoting several linked themes as independent recommendations. Its publishing account was created that day.
Researchers assessed the article as promotional infrastructure for the operation, rather than an unrelated review, based on the wider development evidence.
Cosmic Nebula Themes provided the GlassWorm connection. Its analyzed Marketplace build decrypted embedded JavaScript using AES-256-CBC encryption and immediately executed it.
The recovered loader avoided systems matching Russian-language or Russian-timezone conditions, then consulted Solana blockchain transaction memos to locate additional payload infrastructure.
That mechanism lets attackers change the next download location without publishing a new extension version. Retrieved JavaScript then runs in memory with access to system capabilities.
The shared blockchain address, encryption key, and execution pattern matched previously documented GlassWorm activity, supporting Socket’s high-confidence attribution.
However, shared development evidence does not prove every publisher account belongs to one individual. Nor does it make every related version actively malicious.
Socket found no active payload in the analyzed Coca-Cola Christmas and Aurora Borealis Studio Theme versions, but considered their unnecessary executable functionality high-risk.
Microsoft removed the reported Marketplace extensions after notification. Defenders should inventory themes across both registries and compatible editors, because marketplace removal does not clean installed copies.
Earlier GlassWorm malicious extension updates demonstrate why security reviews must continue after an initially harmless installation. Socket recommends inspecting the packages users install, including activation settings, bundled scripts, network access, process launches, and runtime decryption.
Teams should compare versions after updates and revisit assessments when new intelligence appears, rather than treating public repositories or one-time reviews as sufficient assurance.
Organizations exposed to either confirmed malicious extension should investigate subsequent execution and potentially exposed credentials.
A host where the downloaded command script ran should be treated as potentially compromised. Removing an extension cannot undo actions performed by follow-on payloads; the indicators below support that investigation.
Indicators of compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC
OpenAI has launched GPT-6 Cyber, a security-focused AI model that found 81 new high-severity Firefox…
Shopify is making IP allowlisting mandatory for public apps that call its Admin API, adding…
Microsoft’s Windows Paint vulnerability, CVE-2026-83844, could allow an unauthenticated attacker to execute code over a…
Melbourne, Florida, November 5th, 2026, CyberNewswire OpenMatter Network, a pioneer in decentralized infrastructure for agentic…
A new Android bug named GhostMap can leave a phone stuck in a crash loop…
A China-aligned hacking group is abusing Sogou Input Method, one of the most popular Chinese…