Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware

Researchers identified a GlassWorm v2 supply-chain campaign in which 73 cloned VS Code extensions (six confirmed malicious) were published to Open VSX as sleeper packages; these loaders retrieve a secondary VSIX from GitHub that installs across multiple IDEs (VS Code, Cursor, Windsurf, VSCodium) to run obfuscated JavaScript payloads that avoid Russian systems, steal sensitive data, install a RAT, and deploy a rogue Chromium extension to siphon credentials and bookmarks.