Self-Propagating GlassWorm Weaponizing VS Code Extensions to Attack macOS Users

GlassWorm’s fourth wave targets macOS through malicious VS Code extensions on the Open VSX marketplace, leveraging AES-256-CBC encrypted JavaScript payloads, a 15-minute delay to evade sandboxes, and a Solana blockchain-based decentralized C2; it includes macOS-specific theft (Keychain access), LaunchAgent persistence, and code to trojanize hardware wallet apps, with infrastructure and IP indicators linked to the same actor and over 50,000 downloads reported.