GlassWorm Expands IDE Infection with Zig-Compiled Dropper
Security researchers warn that the GlassWorm campaign uses a Zig-compiled native dropper embedded in an Open VSX extension masquerading as WakaTime to scan a host for multiple IDEs (including VS Code, VS Code Insiders, and forks), download a malicious VSIX, and silently install it across all IDEs. A second-stage dropper then exfiltrates data, deploys a remote-access trojan, and installs an info-stealing Chrome extension, with indicators suggesting broad compromise for affected users.