GlassWorm evolves with Zig dropper to infect multiple developer tools

The GlassWorm campaign uses a Zig-compiled dropper embedded in fake IDE extensions (impersonating tools like WakaTime) to run outside the JavaScript sandbox, scan for multiple IDEs (VS Code, Cursor, VSCodium), and install a second-stage GlassWorm dropper that deploys a persistent RAT, steals data, and installs a malicious Chrome extension; researchers provided IoCs and recommend treating affected systems as fully compromised and rotating exposed credentials.