GlassWorm-linked malicious VS Code theme extensions across VS Code Marketplace and Open VSX deliver staged loaders using Solana blockchain dead-drops and AES-encrypted payloads to steal developer credentials. Two confirmed malicious VS Code theme extensions deliver staged malware loaders. Cosmic Nebula Themes decrypts AES-256-CBC embedded JavaScript, queries a Solana address for next-stage infrastructure via transaction memos, and executes remote code in memory with Node.js capabilities. Aurora Nocturne Night Theme downloads and executes a batch file linked to XWorm RAT infrastructure.
solana-dead-drop
1 post
Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX