macOS Developers in the Crosshairs: GlassWorm’s Wave 4 Exploits VS Code to Trojanize Hardware Wallets

The GlassWorm threat actor, long known for embedding malicious code in Visual Studio Code extensions, has launched a fourth wave targeting macOS developers, with encrypted payloads designed to compromise software wallets and hardware wallets such as Ledger and Trezor. The campaign, which has already racked up 50,000 downloads, uses AES-256-CBC encrypted payloads embedded into compiled JavaScript and leverages AppleScript for stealth execution alongside LaunchAgents for persistence.

It also introduces a time-delay fuse—15 minutes after a developer installs the extension, the real payload drops—to evade automated analysis, with a 900,000 millisecond delay noted. Crucially, the malware can replace legitimate hardware wallet software by checking for Ledger Live or Trezor Suite and then downloading a trojanized replacement, removing the legitimate app and installing the malicious version in its place; the C2 servers tied to this payload were returning empty files at the time of analysis.

According to KOI Security, this marks an active, adaptive shift in GlassWorm’s tactics, linking infrastructure to the same C2 server previously used in Wave 3 from the 45.32.151[.]157 address.