GlassWorm started as invisible-Unicode tricks hidden in a handful of VS Code extensions. Eight months and five waves later, it had poisoned hundreds of GitHub repos — until CrowdStrike, Google, and Shadowserver cut its command-and-control off at the root.
GlassWorm is a self-spreading malware campaign that infected VS Code and OpenVSX extensions between October 2025 and May 2026, stealing developer credentials and cryptocurrency wallet data across five escalating waves — until a coordinated takedown by CrowdStrike, Google, and the Shadowserver Foundation cut its infrastructure off in May 2026.
If you installed a VS Code or OpenVSX extension anytime in that window, it's worth 5 minutes to check whether you were affected. Here's the full story.
Security firm Koi Security first documented GlassWorm in late October 2025, identifying a campaign where attackers used VS Code extensions on the Open VSX Registry and Microsoft's official Extension Marketplace to harvest OpenVSX, GitHub, and Git credentials, drain funds from dozens of cryptocurrency wallet extensions, and drop remote-access tools. The signature trick, and the reason it evaded review, was that the malicious code was hidden using invisible Unicode characters — characters that render as nothing in a code editor but are still executed. This let the code slip past both human review and automated scanning, and stolen credentials were reused to compromise further extensions, creating a self-replicating, worm-like spread.
Wave 1 (October 2025) — Seven OpenVSX extensions were compromised, racking up nearly 36,000 downloads combined, with several still actively distributing malware two days after discovery. OpenVSX rotated compromised tokens and declared the incident contained.
Wave 2 (November 2025) — The threat resurfaced using the same invisible-Unicode technique, and researchers found it had expanded to specifically target GitHub, using stolen credentials to push malicious commits directly into repositories.
Wave 3 (early December 2025) — 24 new malicious packages appeared across OpenVSX and the Microsoft marketplace, with package names deliberately mimicking popular frameworks like Flutter, Vim, Tailwind, Svelte, React Native, and Vue to trick developers into installing impersonator extensions. This is the wave the original reporting treated as the endpoint — but it wasn't.
Wave 4 (late December 2025 – January 2026) — The campaign pivoted to macOS for the first time, using a Solana blockchain address as its command-and-control channel, and attempted to replace legitimate hardware wallet apps with trojanized versions. This was the fourth distinct wave in just over two months, the first aimed exclusively at Mac developers.
Wave 5 (March 2026) — The malware evolved further, gaining the ability to deploy a remote access trojan, log keystrokes, capture screenshots, and take commands from a C2 server hidden inside a Solana blockchain memo, while also beginning to target MCP servers. A parallel campaign wave abused 72 Open VSX extensions, and separately, 88 malicious npm packages were uploaded across three additional waves between November 2025 and February 2026, stealing environment variables and CI/CD tokens. A later April 2026 wave added 73 "sleeper" extensions that looked harmless at install time and only turned malicious after a later update — a deliberate shift meant to evade the kind of static, at-install scanning that had caught earlier waves.
The Takedown (May 26, 2026) — CrowdStrike, working with Google and the Shadowserver Foundation, disrupted all command-and-control channels tied to GlassWorm, targeting a campaign that had systematically pursued developers since early 2025 specifically for their access to source repositories, cloud platforms, CI/CD pipelines, and package registries. The operation cut all four of the malware's active C2 channels simultaneously, and CrowdStrike reported that more than 300 GitHub repositories had been poisoned with stolen developer credentials over the campaign's life.
Across its five waves, confirmed targets included GitHub, npm, and OpenVSX account credentials; cryptocurrency wallet data (targeting dozens of wallet-extension types, later trojanizing whole wallet apps on macOS); CI/CD tokens and environment variables; keystrokes, screenshots, and session cookies (added in later waves); and source code and repository access, used to push malicious commits into legitimate projects.
You're at risk if you installed any VS Code or OpenVSX extension between October 2025 and May 2026 — especially ones with generic, popular-sounding names (formatters, theme packs, framework helpers). Since download counts on these marketplaces can be inflated artificially, a high install count is not a sign of safety.
If you think you installed a compromised extension: disconnect from the internet before doing anything else; uninstall the extension and check your .vscode folder for unfamiliar tasks or scripts; rotate every credential the extension could have touched — GitHub tokens, npm tokens, SSH keys, cloud API keys; review recent Git commit history on your repositories for anything you didn't write; if you use a crypto wallet browser extension, move funds to a new wallet rather than trusting the existing one is clean; and run a full system scan — if you're on a team, notify your security lead immediately, because GlassWorm's whole model depended on one compromised developer trusting another's code.
The May 2026 infrastructure takedown cut GlassWorm's active C2 channels, which stops existing infections from receiving new commands or exfiltrating fresh data. It does not retroactively undo any theft that already happened, and it doesn't guarantee the same operators won't rebuild under a new name — supply-chain campaigns like this one have historically resurfaced with new infrastructure after takedowns. Treat "taken down" as "contained for now," not "resolved forever."
GlassWorm is a self-spreading malware campaign that infected VS Code and OpenVSX extensions from October 2025 to May 2026, using invisible Unicode characters to hide code from review while stealing developer credentials and cryptocurrency.
Its command-and-control infrastructure was disrupted by CrowdStrike, Google, and the Shadowserver Foundation on May 26, 2026. Existing infections can no longer receive commands through the disrupted channels, but that doesn't undo prior theft, and similar campaigns have returned before under new infrastructure.
At least five distinct waves between October 2025 and April 2026, each introducing new techniques — from invisible Unicode, to macOS-targeted crypto wallet trojans, to encrypted payloads, to "sleeper" extensions that only turned malicious after an update.
Its earliest and most distinctive technique was hiding malicious code using invisible Unicode characters that render as nothing in a code editor but still execute. Later waves added encrypted payloads and delayed activation specifically to defeat static, at-install security scans.
GitHub, npm, and OpenVSX credentials; cryptocurrency wallet data; CI/CD tokens and environment variables; and in later waves, keystrokes, screenshots, and session cookies.
Both. Stolen credentials were used to push malicious commits directly into GitHub repositories — CrowdStrike found more than 300 poisoned repositories by the time of the May 2026 takedown.
It's cross-platform. A dedicated wave in December 2025–January 2026 specifically targeted macOS developers with trojanized cryptocurrency wallet apps.
Review your installed VS Code/OpenVSX extensions for anything unfamiliar, especially generic formatters or theme packs. Check your .vscode folder for scripts or tasks you didn't create, and review recent commits to your repositories for anything you didn't write.
Disconnect from the internet, uninstall the extension, rotate every credential it could have accessed (GitHub, npm, SSH, cloud API keys), move any crypto funds to a new wallet, and run a full system scan.
Not fully. GlassWorm extensions appeared on both the official Microsoft VS Code Marketplace and the community-run OpenVSX registry, and its later "sleeper" strategy specifically exploited the fact that extensions are typically only scanned at install time, not after later updates.
You've reached the end
GlassWorm, Explained: The VS Code Supply-Chain Worm That Took Five Waves and a Google/CrowdStrike Takedown to Stop
The full article has comments, related reading and sharing.