Koi · Published 6 Nov
GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure
By Idan Dardikman, Yuval Ronen, Lotan Sery
Excerpt
Almost three weeks ago, we disclosed GlassWorm - the first self-propagating worm targeting VS Code extensions, using invisible Unicode characters to hide malicious code that literally disappears from code editors. On October 21, 2025, OpenVSX declared the incident "fully contained and closed."
But on November 6, 2025 - sixteen days later - we detected a new wave of GlassWorm infections. Three more extensions compromised. A fresh Solana blockchain transaction providing new C2 endpoints. Same attacker infrastructure, still fully operational.
But here's where this story gets more serious. We managed to access th…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Koi on koi.ai.
Mentioned in the excerpt1
More from Koi1
Koi · Web page · Added 29 Apr
GlassWorm Goes Native: Same Infrastructure, Hardened Delivery
GlassWorm is back. Again. Since we first exposed this campaign in October, we've seen two waves, over 45,000 victims, and one attacker who won't quit. After our last disclosure, things went quiet for a few weeks. Then, on November 22, a familiar Solana wallet…