Quick Summary
On January 30, 2026, a supply chain attack targeted the Open VSX Registry, compromising a legitimate developer’s account to distribute malicious updates embedding GlassWorm malware. Four extensions, previously downloaded over 22,000 times, were affected. This incident highlights significant risks as the malware is designed to steal sensitive data, including Apple macOS credentials and cryptocurrency wallet information.
The Securityish Brief
On January 30, 2026, cybersecurity researchers revealed a supply chain attack on the Open VSX Registry. The attack involved the compromise of a legitimate developer’s account, allowing threat actors to publish malicious versions of four established extensions. These extensions, authored by oorzc, had previously been legitimate tools and had collectively garnered over 22,000 downloads before the malicious updates were identified.
The compromised extensions included the FTP/SFTP/SSH Sync Tool (oorzc.ssh-tools — version 0.5.1), I18n Tools (oorzc.i18n-tools-plus — version 1.6.8), vscode mindmap (oorzc.mind-map — version 1.0.61), and scss to css (oorzc.scss-to-css-compile — version 1.3.4). The malicious versions were designed to deliver GlassWorm malware, which is capable of stealing sensitive information such as Apple macOS credentials and cryptocurrency wallet data.
Understanding the GlassWorm Malware
The GlassWorm malware loader uses advanced techniques like EtherHiding to communicate with command-and-control endpoints while remaining undetected. It also profiles compromised machines to determine their locale before executing its payload, avoiding detection in Russian-speaking regions. This sophisticated approach allows the malware to blend into normal developer workflows, complicating detection efforts.
The malware targets a wide range of sensitive information, including data from Mozilla Firefox and Chromium-based browsers, cryptocurrency wallet files, and user documents. It also extracts developer credentials, which poses a severe risk to enterprise environments, potentially leading to cloud account compromises.
This attack marks a significant shift in tactics for the GlassWorm campaign, which previously relied on typosquatting and brandjacking. By using a legitimate developer account, the threat actors can distribute malware more effectively, making it crucial for users and organizations to remain vigilant.
Organizations should monitor their developer accounts closely and implement strict access controls to prevent unauthorized access. The incident underscores the importance of behavioral detection and rapid response to emerging threats in the cybersecurity landscape.
- FTP/SFTP/SSH Sync Tool (oorzc.ssh-tools — version 0.5.1): A tool for syncing files over various protocols.
- I18n Tools (oorzc.i18n-tools-plus — version 1.6.8): A utility for internationalization tasks.
- vscode mindmap (oorzc.mind-map — version 1.0.61): A mind mapping tool for Visual Studio Code.
- scss to css (oorzc.scss-to-css-compile — version 1.3.4): A tool for compiling SCSS into CSS.
Key Takeaways
- Regularly review and update your developer account credentials to prevent unauthorized access.
- Implement strict access controls and monitor for any unusual activity in your developer accounts.
- Educate your team about the risks of supply chain attacks and the importance of verifying software updates.
- Use security tools that focus on behavioral detection to identify potential threats in real time.
- Stay informed about emerging threats and update your security protocols accordingly.
Key Terms & Concepts
- GlassWorm: In this article, GlassWorm refers to a malware loader designed to steal sensitive information from compromised systems.
- supply chain attack: A supply chain attack is a cyber attack that targets the vulnerabilities in the supply chain of software or hardware.
- EtherHiding: EtherHiding is a technique used by malware to conceal its communication with command-and-control servers.
- command-and-control (C2): C2 refers to the infrastructure used by attackers to remotely control compromised systems.
- developer credentials: Developer credentials are authentication details that grant access to development tools and environments.
Read the original article here: https://thehackernews.com/2026/02/open-vsx-supply-chain-attack-used.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
