The GlassWorm hackers have gotten even better at what they do This article explores glassworm hackers gotten. . This attack is aimed at people who use popular development tools like VS Code, Cursor, and Windsurf.
The attackers use trojanized extensions like code-wakatime-activity-tracker to get out of the sandbox and into the systems of their victims. If you see specstudio/code-wakatime-activity.tracker or floktokbok in your list of extensions, your system has been hacked. Change any passwords that were exposed right away. If a developer uses one of these editors but has VS Code running in the background, the malware will get into both.
It spreads to many development environments by looking for IDEs that work with it, like Visual Studio Code and VS Code Insiders. It also talks to a command-and-control server based on the Solana blockchain and drops a persistent RAT that can steal session cookies and keystrokes.
After the file is downloaded, it is deleted to hide its tracks. Aikido research shows that this second extension is the GlassWorm dropper, which targets systems outside of Russia and uses a malicious OpenVSX extension to install a persistent Remote Access Trojan (RAT). This file is a copy of steoatesautoimport, which is a popular VS Code extension.
