New GlassWorm malware wave targets Macs with trojanized crypto wallets

GlassWorm's fourth wave targets macOS developers by publishing malicious VSCode/OpenVSX extensions that unpack an AES-256-CBC encrypted JavaScript payload which executes after a delay via AppleScript, persists using LaunchAgents, communicates with a Solana-based C2, and steals developer credentials, browser crypto extension data, Keychain passwords, and attempts to replace hardware wallet apps with trojanized versions; three malicious extensions were identified (over 33,000 reported installs) and users are advised to remove the extensions, reset credentials, revoke tokens, and check or reinstall affected systems.