GlassWorm Malware Targets macOS Through Compromised OpenVSX Extensions
- Securityish
- Threats & Incidents
Quick Summary
A new GlassWorm malware attack has emerged, targeting macOS systems via compromised OpenVSX extensions. The attack involved a legitimate developer’s account being compromised, leading to malicious updates for four extensions that were downloaded 22,000 times. This malware is designed to steal sensitive information, including passwords and crypto-wallet data, and can establish remote access to infected systems.
The Securityish Brief
The GlassWorm malware attack specifically targets macOS systems by utilizing compromised OpenVSX extensions. The threat actor gained unauthorized access to the account of a legitimate developer, identified as oorzc, and pushed malicious updates to four extensions: oorzc.ssh-tools v0.5.1, oorzc.i18n-tools-plus v1.6.8, oorzc.mind-map v1.0.61, and oorzc.scss-to-css-compile v1.3.4. These updates were released on January 30 and had been innocuous for two years prior, indicating a likely compromise of the developer’s account.
GlassWorm first appeared in late October, employing invisible Unicode characters to conceal its malicious code while targeting cryptocurrency wallet and developer account details. The malware also supports VNC-based remote access and SOCKS proxying, enhancing its capabilities to exfiltrate sensitive data.
Researchers from Socket reported the malicious packages to the Eclipse Foundation, which oversees the Open VSX platform. The foundation confirmed unauthorized publishing access and took action to revoke tokens and remove the malicious releases. However, the oorzc.ssh-tools extension was completely removed due to multiple malicious releases being discovered.
Currently, the versions of the affected extensions available on the market are clean. However, developers who downloaded the malicious versions are advised to perform a full system clean-up and rotate their passwords and secrets to mitigate potential risks.
Understanding the Implications of GlassWorm
This incident highlights the vulnerabilities associated with third-party extensions and the potential risks they pose to users, especially in development environments. The fact that the malware specifically targets macOS systems and excludes Russian-locale systems raises questions about the attacker’s origin and intent.
Users and organizations should remain vigilant about the extensions they install and regularly monitor their systems for any unauthorized changes or suspicious activity. The GlassWorm attack serves as a reminder of the importance of securing developer accounts and implementing robust security measures to prevent unauthorized access.
Key Takeaways
- Review and remove any extensions from OpenVSX that you do not recognize or use.
- Change passwords and rotate secrets for any accounts associated with the affected extensions.
- Monitor your macOS system for unusual activity or unauthorized access attempts.
- Consider using security tools that can detect and alert on malicious software installations.
- Stay informed about updates and security advisories related to third-party extensions you use.
Key Terms & Concepts
- GlassWorm: In this article, GlassWorm refers to a type of malware that targets macOS systems to steal sensitive information.
- OpenVSX: OpenVSX is an open-source alternative to the Visual Studio Code marketplace, where developers can publish extensions.
- VNC: VNC stands for Virtual Network Computing, a technology that allows remote access to a computer’s desktop.
- SOCKS proxying: SOCKS proxying is a method used to route network traffic through a proxy server, often for anonymity or security.
- LaunchAgent: A LaunchAgent is a macOS feature that allows applications to run automatically at user login.
Read the original article here: https://www.bleepingcomputer.com/news/security/new-glassworm-attack-targets-macos-via-compromised-openvsx-extensions/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
