The Evolution of GlassWorm: How a Known Threat is Rewriting its Playbook through GitHub

Key Takeaways

• Second OpenVSX Wave: Three additional OpenVSX extensions were compromised, resulting in an estimated 10,000 additional downloads.
• Cross-Platform Spread via GitHub: GlassWorm leveraged stolen GitHub credentials to push malicious, seemingly AI-generated commits to repositories, expanding beyond marketplace extensions.
• Blockchain-Resilient C2 Routing: The threat actor issued a new transaction on the Solana blockchain to update next-stage C2 payload locations without modifying the core C2 and exfiltration server IPs.
• Attacker Infrastructure Exposure: Analysis of an exposed C2 server endpoint revealed harvested credentials from organizations spanning the US, Europe, Asia, and South America, as well as operational telemetry linked to Russian-speaking operators.

History of GlassWorm

On October 17, the Cortex AES team disclosed GlassWorm - the first self-propagating worm targeting VS Code extensions, using invisible Unicode characters to hide malicious code that literally disappears from code editors.

On October 21, 2025, OpenVSX declared the incident "fully contained and closed."

But on November 6, 2025 - sixteen days later - we detected a new wave of GlassWorm infections. Three more extensions compromised. A fresh Solana blockchain transaction providing new C2 endpoints. Same attacker infrastructure, still fully operational.

But here's where this story gets more serious. We managed to access the attacker's server. What we found inside confirmed the real-world impact: a partial list of victims from around the world - the US, South America, Europe, Asia - including a major government entity from the Middle East.

This isn't just about compromised extensions anymore. This is about real victims, critical infrastructure at risk, and a worm that's doing exactly what we warned it would do: spreading through the developer ecosystem.

And it's not just OpenVSX. Developers have reported that GlassWorm has jumped to GitHub repositories, using AI-generated commits to hide its invisible payloads in what looks like legitimate code changes.

Second Wave Attacks Target OpenVSX Extensions

On November 6, 2025, Cortex AES risk engine flagged automatically three additional OpenVSX marketplace extensions displaying the distinct GlassWorm signature:

1. ai-driven-dev.ai-driven-dev (~3,300 downloads)
2. adhamu.history-in-sublime-merge (~4,000 downloads)
3. yasuyuky.transient-emacs (~2,400 downloads)

Combined, these compromised packages added approximately 10,000 infected developer endpoints to the campaign's overall reach.

The underlying execution mechanism remained consistent with original findings: malicious logic was obfuscated using unprintable Unicode sequences within the software supply chain. To human eyes, the code appeared as benign blank spaces inside the code editor; to JavaScript interpreters, the characters executed fully.

To distribute stage-two payloads, the operator posted a fresh transaction to the Solana blockchain. Blockchain-based command and control infrastructure provides resilience: even if payload host servers are taken down, updating the transaction on the public ledger costs fractions of a cent and automatically redirects infected endpoints to new C2 locations.

Despite the fresh blockchain routing transaction, the primary hosting and data exfiltration infrastructure remained unchanged:

• Primary C2 Host: 199.247.10[.]166
• Data Exfiltration Endpoint: 199.247.13[.]106:80/wall

Analysis of the Exposed C2 Server

Following reporting from an independent security researcher regarding an exposed server endpoint, investigators gained visibility into the attacker's server infrastructure.

Exposed Victim Telemetry

The server housed a partial snapshot of compromised endpoints. Stolen data included harvested credentials, system environment configurations, and active developer session tokens.

• Global Footprint: Affected organizations were identified across the United States, South America, Europe, and Asia.
• Public Sector Impact: Telemetry confirmed credential theft affecting a major government entity in the Middle East.
• Developer Workstations: Dozens of individual software engineers and corporate developer environments had active session tokens exfiltrated.

Attribution and Telemetry Findings

Exfiltrated server logs and keylogger telemetry provided critical intelligence regarding operational security oversights:

• Language Context: Keylogger logs and system configuration artifacts contained Russian-language system indicators.
• C2 Framework: The infrastructure incorporated RedExt, an open-source browser extension C2 framework.
• Account Identifiers: Investigators identified specific user IDs linked to cryptocurrency exchanges and messaging channels, which were shared with law enforcement authorities to assist attribution efforts.

Campaign Expansion to GitHub Repositories

Research published by Aikido Security on October 31, 2025, confirmed that GlassWorm had expanded beyond extension marketplaces into public and private GitHub repositories.

Developers reported unauthorized repository commits that mimicked legitimate project modifications. The commits appeared to be generated using AI coding tools to blend naturally into standard code contributions.

Embedded within these code changes were malicious payloads hidden via Private Use Area (PUA) Unicode encodings. Once executed, the decoded JavaScript invoked the same Solana-based C2 lookup mechanism observed in the extension-based campaign. By leveraging stolen developer access tokens, the malware automatically pushed infected code changes to other repositories under the developer's control, establishing self-propagating worm behavior.

Indicators of Compromise (IOCs)

The following indicators were identified during the November 2025 investigation. Network indicators have been defanged for safety.

Compromised OpenVSX Extension Identifiers:

• adhamu.history-in-sublime-merge@1.3.4
• yasuyuky.transient-emacs@0.23.1
• ai-driven-dev.ai-driven-dev@0.4.11

Command and Control Infrastructure:

• 199.247.10[.]166 (Primary C2 Server)
• 199.247.13[.]106:80/wall (Data Exfiltration Endpoint)

Conclusion and Defensive Guidance

The evolution of GlassWorm underscores the vulnerabilities inherent in modern developer workflows and ecosystem extensions. When malicious code relies on invisible characters, uses decentralized blockchains for C2 resilience, and propagates via legitimate source control platforms, traditional static analysis tools alone are insufficient.

Securing the software supply chain requires continuous visibility across IDE extensions, developer credentials, and code repositories. Learn how Cortex Agentic Endpoint Security provides unified governance across developer tools, build pipelines, and code repositories to stop threats before they propagate.