Trusted Design

73 Open VSX Sleeper Extensions Linked to Malware Show New Activations

概要

The GlassWorm campaign targeting Open VSX has escalated with 73 newly identified impersonation extensions. These sleeper extensions were initially published without malicious payloads by newly created GitHub accounts, appearing benign to build trust and credibility. At least six extensions have been activated to deliver malware through normal update mechanisms. The extensions clone popular legitimate listings with similar branding, icons, and descriptions, making detection difficult. The threat actor has shifted delivery methods away from embedded loaders toward transitive delivery via extension dependencies, external payload retrieval from GitHub-hosted VSIX files, and native binary execution. Some variants use obfuscated JavaScript to decode and retrieve payloads at runtime. The malicious code targets multiple IDEs including VS Code, Cursor, Windsurf, and VSCodium, installing downloaded extensions through command-line interfaces.

Created: 2026-04-28

Indicators

• FileHash-SHA256 - 97c275e3406ad6576529f41604ad138c5bdc4297d195bf61b049e14f6b30adfd -
• FileHash-MD5 - 28d59940483fa3bea0599ce55aa86245 -
• FileHash-SHA1 - c074880abdbf87a9fd2e1393d4cb36c32f1f8f58 -
• FileHash-SHA256 - 1b62b7c2ed7cc296ce821f977ef7b22bae59ef1dcdb9a34ae19467ee39bcf168 -
• FileHash-SHA256 - 4ebfe8f66ca7e9751060b3301b5e8838d6017593cdae748541de83bfa28183bd -

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る