cyber.hendryadrian.com
Threat Research · thehackernews.com

GlassWorm Uses Zig Dropper to Target Multiple Developer IDEs

· Original article ↗

Summary

A malicious Open VSX extension impersonating WakaTime uses Zig-compiled Node.js addons to install a second-stage extension across VS Code-compatible IDEs. Researchers say it retrieves C2 via Solana, deploys a RAT and Chrome data stealer, and advise exposed users to

Key points

  • The Open VSX extension specstudio.code-wakatime-activity-tracker impersonated WakaTime; it is no longer available for download.
  • The extension includes Zig-compiled native Node.js addons that execute outside the JavaScript sandbox with operating-system-level access.
  • The dropper searches for IDEs supporting VS Code extensions and silently installs floktokbok.autoimport, downloaded from an attacker-controlled GitHub account.
  • Researchers say the second-stage extension avoids execution on Russian systems, retrieves C2 details via the Solana blockchain, exfiltrates sensitive data, and installs a RAT and a Chrome information-stealing extension.
  • Users who installed either malicious extension are advised to assume compromise and rotate all secrets.

Article Details

Attack Vectors
  • A malicious Open VSX extension, specstudio.code-wakatime-activity-tracker, impersonated WakaTime and included Zig-compiled native Node.js addons that execute outside the JavaScript sandbox.
  • The native binary searched for IDEs that support VS Code extensions, then downloaded the malicious floktokbok.autoimport VSIX from an attacker-controlled GitHub account and silently installed it in those IDEs.
  • The second-stage extension retrieved C2 details from the Solana blockchain, avoided execution on Russian systems, exfiltrated sensitive data, and installed a RAT and an information-stealing Google Chrome extension.
Defensive Notes
  • Users who installed specstudio.code-wakatime-activity-tracker or floktokbok.autoimport are advised to assume compromise and rotate all secrets.
  • The specstudio.code-wakatime-activity-tracker extension was no longer available for download at the time of reporting.

MITRE ATT&CK

T1105 · Ingress Tool TransferThe native binary downloads the malicious floktokbok.autoimport VSIX from an attacker-controlled GitHub account.T1129 · Shared ModulesThe Zig-compiled win.node or mac.node native addon loads into Node.js as a shared library and executes outside the JavaScript sandbox.T1176 · Software ExtensionsThe second stage silently installs a malicious extension in IDEs, and ultimately deploys an information-stealing Google Chrome extension.

People

Ilyas MakariAikido Security researcher credited with analyzing the malicious extension and its Zig-compiled native binary.

Malware

GlassWormResearchers have identified a new GlassWorm evolution that uses a Zig-compiled native dropper embedded in a malicious Open VSX extension impersonating WakaTime to stealthily infect multiple IDEs.

Products

CursorThis includes Microsoft VS Code and VS Code Insiders, as well as forks like VSCodium, Positron, and a number of artificial intelligence (AI)-powered coding tools like Cursor and Windsurf.Google Chromedata, and installs a remote access trojan (RAT), which ultimately deploys an information-stealing Google Chrome extension.Node.jsThe dropper installs native Node.js addons, fetches and silently installs a second-stage extension (floktokbok.autoimport) that retrieves C2 info via the Solana blockchain, deploys a RAT and a data-stealing ChromeOpen VSXResearchers have identified a new GlassWorm evolution that uses a Zig-compiled native dropper embedded in a malicious Open VSX extension impersonating WakaTime to stealthily infect multiple IDEs.PositronThis includes Microsoft VS Code and VS Code Insiders, as well as forks like VSCodium, Positron, and a number of artificial intelligence (AI)-powered coding tools like Cursor and Windsurf.Solanaand silently installs a second-stage extension (floktokbok.autoimport) that retrieves C2 info via the Solana blockchain, deploys a RAT and a data-stealing Chrome extension, and users who installed the extensionsVisual Studio Code InsidersThis includes Microsoft VS Code and VS Code Insiders, as well as forks like VSCodium, Positron, and a number of artificial intelligence (AI)-powered coding tools like Cursor and Windsurf.VSCodeThe newly identified Microsoft Visual Studio Code (VS Code) extension is a near replica of WakaTime, save for a change introduced in a function named “activate().” The extension installs a binary named “win.node” onVSCodiumThis includes Microsoft VS Code and VS Code Insiders, as well as forks like VSCodium, Positron, and a number of artificial intelligence (AI)-powered coding tools like Cursor and Windsurf.WakaTimeResearchers have identified a new GlassWorm evolution that uses a Zig-compiled native dropper embedded in a malicious Open VSX extension impersonating WakaTime to stealthily infect multiple IDEs.WindsurfThis includes Microsoft VS Code and VS Code Insiders, as well as forks like VSCodium, Positron, and a number of artificial intelligence (AI)-powered coding tools like Cursor and Windsurf.

Related Articles