The ongoing GlassWorm campaign has recently been identified using a new method involving a Zig dropper, aimed at infiltrating integrated development environments (IDEs) on developers’ machines. This technique was discovered in an Open VSX extension named specstudio.code-wakatime-activity-tracker, which masquerades as WakaTime, a widely used tool for tracking programming time within IDEs. The extension has since been removed from download.
According to Aikido Security researcher Ilyas Makari, the extension includes a Zig-compiled native binary alongside its JavaScript code. This marks a continuation of GlassWorm’s strategy of utilizing natively compiled code within extensions. However, the binary is not the direct payload; instead, it serves as a stealthy means to deploy the known GlassWorm dropper, which seeks to infect all IDEs present on the system.
Technical Details of the Infection
The identified extension closely resembles WakaTime, with a notable alteration in a function called activate(). On Windows systems, it installs a binary named win.node, while on macOS, it installs mac.node, a universal Mach-O binary. These Node.js native addons are compiled shared libraries written in Zig, allowing them to execute outside the JavaScript sandbox and gain full operating system-level access.
Once activated, the binary’s primary function is to locate every IDE on the system that supports VS Code extensions. This includes Microsoft VS Code, VS Code Insiders, and various forks like VSCodium, as well as AI-powered coding tools such as Cursor and Windsurf. The binary then downloads a malicious VS Code extension, floktokbok.autoimport, from an attacker-controlled GitHub account. This extension impersonates steoates.autoimport, a legitimate extension boasting over 5 million installations on the official Visual Studio Marketplace.
Consequences and Recommendations
The downloaded .VSIX file is written to a temporary path and silently installed into each IDE using the command-line interface installer. The second-stage extension functions as a dropper, designed to avoid execution on Russian systems, communicate with the Solana blockchain for command-and-control (C2) server instructions, exfiltrate sensitive data, and install a remote access trojan (RAT). This ultimately leads to the deployment of an information-stealing Google Chrome extension.
Users who have installed either specstudio.code-wakatime-activity-tracker or floktokbok.autoimport are advised to assume their systems may be compromised and should rotate all sensitive credentials.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
