7 minhigh
Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
GlassWorm-linked malicious VS Code theme extensions across VS Code Marketplace and Open VSX deliver staged loaders using Solana blockchain dead-drops and AES-encrypted payloads to steal developer credentials. Two confirmed malicious VS Code theme extensions deliver staged malware loaders. Cosmic Nebula Themes decrypts AES-256-CBC embedded JavaScript, queries a Solana address for next-stage infrastructure via transaction memos, and executes remote code in memory with Node.js capabilities. Aurora Nocturne Night Theme downloads and executes a batch file linked to XWorm RAT infrastructure.
Sens:■ Immediate
IOCs12
4sha2563domain2ip1filename1file path1url
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Remove Aurora Nocturne Night Theme and Cosmic Nebula Themes from all developer workstations
- Hunt for fingercakes4sale.store, temp_batch.cmd, and cmd.exe spawned by VS Code extension host
- Block 45.157.233.46, 173.232.146.211, fingercakes4sale.store, and mountaingoats4sale.xyz at network controls
- Treat hosts with confirmed payload execution as compromised and investigate for credential exposure
Key Takeaways
- Aurora Nocturne concealed a 59KB obfuscated JavaScript loader using zero-width Unicode character encoding
- Cosmic Nebula Themes uses Solana transaction memos as dead-drop resolvers for dynamic C2 infrastructure
- Russian-language and timezone gating causes the loader to exit on matching systems
- Cluster spans 10 extensions across two registries with tens of thousands of total downloads
- XWorm RAT C2 at 45.157.233.46:25565 linked through WDS.bat from mountaingoats4sale.xyz
Attack Chain
- Initial Access: Malicious VS Code theme extensions published on VS Code Marketplace and Open VSX registries
- Execution: Extension activates on "*", decrypts AES-256-CBC embedded JavaScript, executes via eval()
- Defense Evasion: Russian-language and timezone gating exits on matching systems; zero-width Unicode obfuscation
- C2 Resolution: Solana blockchain transaction memos queried to dynamically resolve next-stage payload URL
- Ingress Tool Transfer: Downloads batch file to %TEMP%\temp_batch.cmd from attacker-controlled domain
- Persistence: Batch file executes via cmd.exe with hidden window; XWorm RAT establishes hidden scheduled task
Affected Systems
- VS Code and VS Code-compatible editors
- Cursor IDE
- Windows developer workstations
- Systems with installed VS Code theme extensions
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | cmd.exe spawns from extension host are visible; in-memory JS execution via vm.createContext is harder to inspect. |
| Network Visibility | Medium | HTTPS to attacker domains visible; Solana RPC endpoint is legitimate infrastructure, blending with normal traffic. |
| Detection Difficulty | Hard | Dynamic C2 via Solana blockchain, AES-encrypted payloads, and abuse of legitimate RPC infrastructure complicate static detection. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| VS Code extension host process spawning cmd.exe or powershell.exe to execute files from temp directories (T1059.003) | Process creation with parent extension host | Execution | Low — theme extensions rarely spawn shells |
| Processes querying Solana RPC endpoints then connecting to dynamically resolved URLs with ivbase64 and secretkey headers (T1102.001) | DNS and HTTP proxy logs with header capture | Command and Control | Low — custom headers are unusual for normal dev traffic |
| JavaScript eval() or vm.createContext() execution within VS Code extension host process loading remote code (T1620) | EDR script execution or memory inspection | Execution | Medium — some legitimate extensions use eval |
| Files written to %TEMP% and immediately executed by cmd.exe with windowsHide option (T1105, T1564.002) | File creation followed by process creation events | Ingress Tool Transfer | Low — hidden window execution from temp is rare |
Required Log Sources
- Process creation events (Sysmon EID 1)
- DNS resolution logs
- HTTP proxy logs
- VS Code extension logs
- PowerShell script block logs (EID 4104)
- File creation events (Sysmon EID 11)
Key Behavioral Indicators
- Theme extension with activationEvents wildcard and executable JavaScript entrypoint
- Extension host process spawning cmd.exe with windowsHide option
- HTTP responses containing ivbase64 and secretkey headers
- AES-256-CBC decryption followed by eval() in extension context
- Solana RPC API queries from developer workstations followed by new connections
- Russian-language source comments in theme definitions across cluster extensions
Control Gaps
- VS Code lacks granular permission controls for extension code execution
- Static IOC blocking fails against Solana-based dynamic C2 resolution
- Public source repository differs from distributed extension artifact
- No runtime sandboxing for VS Code extension network access or process execution
False Positive Assessment
Low — theme extensions with executable JavaScript, Solana blockchain queries, and AES-encrypted payloads have no legitimate use case; Russian-language gating and custom HTTP headers further reduce false positives.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block and alert on Solana RPC API access from developer workstations unless explicitly required
- Deploy proxy inspection for HTTPS traffic from VS Code extension host processes
- Restrict extension installation to approved publishers via marketplace policy controls
- Monitor for ivbase64 and secretkey HTTP response headers on outbound developer traffic
User Protection
- Audit all installed VS Code and Open VSX extensions across developer fleet for cluster-linked identifiers
- Inspect package.json activationEvents and executable entrypoints in all theme extensions
- Remove extensions with unnecessary executable JavaScript that only provide visual customization
- Re-evaluate currently benign extensions in the cluster for future weaponization via updates
Security Awareness
- Educate developers that VS Code themes should not contain executable JavaScript code
- Train developers to verify extension publisher identity before installation
- Warn developers that public source repositories may differ from distributed extension artifacts
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping11 techniques
Tactic
Initial Access
Tactic
Stealth
Tactic
Discovery
Tactic
Command and Control
Additional IOCs
- File Hashes:
5e68ca8c2097caccdb74d2752b85b85595a4bf646b442b8431a2416e87dbf268(SHA256) - Aurora Nocturne obfuscated extension.js hashda2d950e50326171adbff9c2bfd6f28998e32623ea7c2c475b9159a45cfb86bb(SHA256) - Cosmic Nebula decrypted second-stage loader hash
- File Paths:
%TEMP%\temp_batch.cmd- Aurora Nocturne writes downloaded payload to this path
- Command Lines:
- Purpose: Execute downloaded batch script with hidden window | Tools:
cmd.exe| Stage: Execution |cmd.exe /c
- Purpose: Execute downloaded batch script with hidden window | Tools:
- Other:
wDO6YyTm6DL0T0zJ0SXhUql5Mo0pdlSz- AES-256-CBC key embedded in Cosmic Nebula loader4c4b9a3773e9dced6015a670855fd32b- AES IV embedded in Cosmic Nebula loader[email protected]- Git commit author identity linking Aurora and Coca-Cola projects[email protected]- Git commit author and Aurora Borealis publisher identity[email protected]- Associated support email for cluster extensionscosmic-themes.theme-cosmic-nebula- Confirmed malicious Open VSX extension identifiercosmic-themes.sql-formatter- Previously identified GlassWorm Open VSX extensionholiday-themes.theme-coca-cola-christmas- Cluster-linked Open VSX extension identifierlohsebhipolg2s.theme-aurora-borealis- Cluster-linked extension identifier across both registriesaurora-them-creator.theme-aurora-nocturne- Cluster-linked Open VSX extension identifiersolidity-syntax.deep-focus- Cluster-linked Open VSX extension identifiercharcoal-mint-studio.theme-charcoal-mint- Cluster-linked Open VSX extension identifieraubineherodvulbdl/Aurora-Nocturne-Dreams- GitHub repository for confirmed malicious Aurora Nocturnehakhangthu7558-sys/Coca-Cola-Christmas- GitHub repository for cluster-linked Coca-Cola Christmasvovanloc2234-sudo/Cosmic-Nebula-Themes- GitHub repository for confirmed malicious Cosmic Nebula Themes
Showing defanged values
- domainfingercakes4sale[.]storeAurora Nocturne C2 download domain for batch payload
- domainholiday-themes[.]devThreat actor support domain for cluster extensions
- domainmountaingoats4sale[.]xyzXWorm secondary payload download domain serving WDS.bat
- filenametemp_batch.cmdDropped batch file executed by Aurora Nocturne loader
- file_path%TEMP%\temp_batch.cmdAurora Nocturne writes downloaded payload to this path
- ip173[.]232[.]146[.]211Historical resolution of fingercakes4sale.store in malware telemetry
- ip45[.]157[.]233[.]46XWorm RAT C2 server on port 25565
- sha2565e68ca8c2097caccdb74d2752b85b85595a4bf646b442b8431a2416e87dbf268Aurora Nocturne obfuscated extension.js hash
- sha256684c877a52d226d50584cb886ca8ec5bec6355d4de853f406734c79d5b387804Cosmic Nebula Themes app.js malicious entrypoint hash
- sha256a276b76d3b00f302bb4dfb3690125c85ff472b16049c3c37476ac5e51096df07Aurora Nocturne VSIX package hash
- sha256da2d950e50326171adbff9c2bfd6f28998e32623ea7c2c475b9159a45cfb86bbCosmic Nebula decrypted second-stage loader hash
- urlhxxps://fingercakes4sale[.]store/dsyuCAurora Nocturne payload download URL for batch script
