New GlassWorm malware wave targets Macs with trojanized crypto wallets

Published:

1 januari 2026 om 15:18:23

Alert date:

1 januari 2026 om 20:02:29

Source:

bleepingcomputer.com

Operating Systems, Supply Chain & Dependencies, Ransomware & Malware, Data Breach & Exfiltration

A fourth wave of the GlassWorm campaign is actively targeting macOS developers through malicious VSCode/OpenVSX extensions. The campaign delivers trojanized versions of cryptocurrency wallet applications to compromise Mac systems. This represents an ongoing and evolving threat specifically targeting the developer community with supply chain attacks through compromised development tools and cryptocurrency-related software.

Technical details

Fourth wave of GlassWorm campaign targeting macOS developers with malicious VSCode/OpenVSX extensions. Uses AES-256-CBC encrypted payload embedded in compiled JavaScript. Executes after 15-minute delay to evade sandbox analysis. Uses AppleScript instead of PowerShell and LaunchAgents for persistence. Maintains Solana blockchain-based C2 mechanism. Targets over 50 browser crypto extensions, developer credentials, browser data, and Keychain passwords. Attempts to replace hardware cryptocurrency wallet apps (Ledger Live, Trezor Suite) with trojanized versions.

Mitigation steps:

Remove the three malicious extensions immediately if installed
Reset GitHub account passwords
Revoke NPM tokens
Check system for signs of infection
Consider reinstalling the system if infected
Verify publisher verification status before installing VSCode extensions

Affected products:

macOS
Visual Studio Code
OpenVSX registry
Microsoft Visual Studio Marketplace
GitHub accounts
NPM accounts
Cryptocurrency wallet extensions
Ledger Live
Trezor Suite
macOS Keychain