GlassWorm v3 Supply Chain Attack — 72 Malicious Open VSX Extensions, 151 GitHub Repos & ZOMBI Botnet Module

Key facts for GlassWorm v3 ZOMBI module

Detection coverage for GlassWorm v3 ZOMBI module

As of 2026-03-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0231 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GlassWorm v3 — Malicious VS Code Extension Payload Execution

Detects VS Code extension host process spawning child processes with command line patterns indicative of GlassWorm v3 payload execution, including eval() calls on decoded Unicode payloads, AES-256-CBC decryption routines, 15-minute sandbox evasion delays (setTimeout 900000), and known GlassWorm URI path references. Targets the initial exploitation phase where a malicious Open VSX or VS Code Marketplace extension activates and executes the invisible Unicode-encoded JavaScript loader.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1059.007, T1027
• Data sources: sysmon, windows_security, microsoft_defender_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(ParentImage="*\\Code.exe" OR ParentImage="*\\code" OR ParentCommandLine="*extensionHost*")
(Image="*\\node.exe" OR Image="*\\cmd.exe" OR Image="*\\powershell.exe")
| eval suspicious=if(match(CommandLine, "(?i)(eval\(|Function\(|fromCharCode|setTimeout.*900000|AES|decrypt|get_zombi|get_arhive|ijewf|\\xFE0|\\uFE0)"), 1, 0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands by Computer, User, ParentImage, Image
| where count > 0
| table Computer, User, ParentImage, Image, commands, count, first_seen, last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "Code.exe" or InitiatingProcessCommandLine has "extensionHost"
| where FileName in~ ("node.exe", "cmd.exe", "powershell.exe")
| where ProcessCommandLine has_any ("eval(", "Function(", "fromCharCode", "setTimeout", "900000", "get_zombi", "get_arhive", "ijewf", "\\xFE0", "\\uFE0", "AES", "decrypt")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Commands=make_set(ProcessCommandLine) by DeviceName, AccountName, FileName

Sigma

title: GlassWorm v3 Malicious VS Code Extension Payload Execution
id: 48d7fc66-de25-4eef-b0a9-e015ace6c032
status: experimental
description: Detects VS Code extension host spawning child processes with command line patterns indicative of GlassWorm v3 Unicode-decoded payload execution via eval(), AES decryption, or sandbox evasion delays
references:
    - https://intel.threadlinqs.com/threat/TL-2026-0231
    - https://thehackernews.com/2026/03/glassworm-supply-chain-attack-abuses-72.html
    - https://www.aikido.dev/blog/glassworm-returns-unicode-attack-github-npm-vscode
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/03/15
tags:
    - attack.initial_access
    - attack.t1195.002
    - attack.execution
    - attack.t1059.007
    - attack.defense_evasion
    - attack.t1027
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\\Code.exe'
            - '\\code'
    selection_parent_cmdline:
        ParentCommandLine|contains: 'extensionHost'
    selection_child:
        Image|endswith:
            - '\\node.exe'
            - '\\cmd.exe'
            - '\\powershell.exe'
    selection_suspicious:
        CommandLine|contains:
            - 'eval('
            - 'Function('
            - 'fromCharCode'
            - 'setTimeout'
            - '900000'
            - 'get_zombi'
            - 'get_arhive'
            - 'ijewf'
    condition: (selection_parent or selection_parent_cmdline) and selection_child and selection_suspicious
falsepositives:
    - Legitimate VS Code extensions using eval() for code transformation or transpilation
    - Development tools with intentionally obfuscated code
level: high

Known false positives:

• Legitimate VS Code extensions using eval() for code transformation
• Development tools with intentionally obfuscated code

Tuning notes: Exclude known legitimate extensions by adding ParentCommandLine exclusions for trusted extension IDs. Adjust setTimeout threshold if legitimate extensions use long delays. Add allowlist for internal developer tooling that uses eval().

• 🔒 GlassWorm v3 — Unicode PUA Character Injection in Source Code Files · unlock with TL Creds
• 🔒 GlassWorm v3 — Developer Credential File Access by Non-Standard Process · unlock with TL Creds
• 🔒 GlassWorm v3 — Solana Dead-Drop Resolver and Google Calendar Fallback C2 · unlock with TL Creds
• 🔒 GlassWorm v3 — Malicious npm/Extension Package Installation with Remote Dynamic Dependencies · unlock with TL Creds
• 🔒 GlassWorm v3 — ZOMBI Data Staging in Temporary Directory · unlock with TL Creds
• 🔒 GlassWorm v3 — ZOMBI SOCKS Proxy, HVNC, and P2P Botnet Activity · unlock with TL Creds
• 🔒 GlassWorm v3 — ZOMBI Module Registry and LaunchAgent Persistence · unlock with TL Creds
• 🔒 GlassWorm v3 — C2 Communication to Known Infrastructure · unlock with TL Creds

Indicators of compromise for GlassWorm v3 ZOMBI module

As of 2026-03-15, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-0231.

Sample indicators (3 of 25)

• IP address: 217.69.3[.]218
• URL: hxxps://calendar[.]app[.]google/M2ZCvM8ULL56PD1d6
• Email address: uhjdclolkdn[@]gmail[.]com

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

How GlassWorm v3 ZOMBI module works

The campaign uses a triple-layer C2 architecture combining Solana blockchain dead-drop resolvers, direct IP connections, and Google Calendar fallback channels.

GlassWorm v3 represents a significant escalation of the GlassWorm supply chain campaign first identified in March 2025. The third wave, active from January through March 2026, abuses Open VSX extensionPack and extensionDependencies fields to create transitive delivery vehicles that pull malicious payloads after trust is established.

The attack chain begins with benign-appearing extensions published to the Open VSX marketplace and VS Code Marketplace. These extensions mimic popular developer utilities including linters, formatters, code runners, and AI-powered coding assistants (impersonating tools like Claude Code and Google Antigravity). Post-publication updates introduce malicious dependencies through extensionPack exploitation and Remote Dynamic Dependencies (RDD) via custom HTTP URLs in package.json.

The obfuscation layer uses Private Use Area (PUA) Unicode characters in the ranges 0xFE00-0xFE0F (variation selectors) and 0xE0100-0xE01EF (supplementary markers) to encode malicious payloads as invisible characters. The injection appears as empty backtick blocks but contains hidden character sequences that decode to full malicious loaders executed via eval(). Surrounding changes are AI-generated and realistic — documentation tweaks, version bumps, small refactors, and bug fixes — making detection extremely difficult.

The C2 infrastructure employs a triple-layer resilience architecture: (1) Solana blockchain transactions serve as dead-drop resolvers — the wallet 28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2 stores C2 addresses in transaction memos that cannot be taken down; (2) direct IP connections to 217.69.3.218 and 199.247.10.166 for payload delivery; (3) Google Calendar (calendar.app.google/M2ZCvM8ULL56PD1d6) as a fallback C2 channel.

The final payload is the ZOMBI module — a massive JavaScript RAT that transforms infected developer workstations into criminal infrastructure nodes. ZOMBI capabilities include: credential harvesting (NPM tokens, GitHub tokens, Open VSX credentials, Git credentials, AWS keys, SSH keys), cryptocurrency wallet draining targeting 49 wallet extensions (MetaMask, Coinbase Wallet, Phantom, Electrum, Exodus, Atomic, Ledger, Trezor, Binance, TonKeeper), hidden VNC (HVNC) for invisible remote desktop access, SOCKS proxy for routing traffic through corporate networks, and WebRTC/BitTorrent networking for P2P botnet communication.

The malware performs locale checks to avoid infecting systems with a Russian locale, suggesting Russian-speaking actors. Attribution points to 'PhantomRaven' — an entity that deliberately rotated account names and email addresses to evade tracking. The campaign evolved through four waves: initial Unicode npm attacks (March 2025), first OpenVSX compromise (October 2025), compromised developer account attack (January 2026), and the current mass injection campaign (March 2026).

The GitHub injection campaign (March 3-9, 2026) targeted 151+ repositories including projects with significant star counts (pedronauck/reworm with 1,460 stars). The malware includes a 15-minute execution delay before decrypting and running an AES-256-CBC JavaScript payload, evading sandbox analysis. Persistence mechanisms include Windows Registry Run keys (HKCU and HKLM) and macOS LaunchAgents. Data is staged in /tmp/ijewf/ before exfiltration to 140.82.52.31:80/wall and 199.247.13.106:80/wall.

MITRE ATT&CK techniques by tactic:

collection

T1005 Data from Local System; T1074 Data Staged

command-and-control

T1008 Fallback Channels; T1071 Application Layer Protocol; T1102 Web Service; T1219 Remote Access Tools; T1571 Non-Standard Port

defense-evasion

T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion

exfiltration

T1048 Exfiltration Over Alternative Protocol

execution

T1059 Command and Scripting Interpreter; T1204 User Execution

discovery

T1082 System Information Discovery; T1614 System Location Discovery

persistence

T1176 Software Extensions; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

initial-access

T1195 Supply Chain Compromise

impact

T1496 Resource Hijacking

credential-access

T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Remediation for GlassWorm v3 ZOMBI module

Immediate actions

• Audit all installed VS Code and Open VSX extensions against known malicious extension list
• Block C2 IPs at perimeter: 217.69.3.218, 199.247.10.166, 140.82.52.31, 199.247.13.106
• Search for /tmp/ijewf/ staging directory on all developer workstations
• Rotate ALL developer credentials: NPM tokens, GitHub tokens, Open VSX tokens, AWS keys, SSH keys
• Check Windows Registry Run keys and macOS LaunchAgents for unauthorized persistence
• Scan for invisible Unicode characters (PUA range 0xFE00-0xFE0F, 0xE0100-0xE01EF) in code repos

Workarounds

• Disable automatic extension updates in VS Code until audit is complete
• Pin extension versions to known-good releases
• Use VS Code extension verification via signature checking where available
• Restrict package.json from referencing external HTTP URLs

Longer-term hardening

• Implement extension allowlisting policies for VS Code and Open VSX
• Deploy EDR with behavioral detection for credential harvesting and SOCKS proxy creation
• Monitor Solana blockchain transactions for C2 dead-drop resolution patterns
• Implement package manifest auditing for Remote Dynamic Dependencies (RDD)
• Enable Unicode character visibility in code review tools and CI/CD pipelines
• Deploy network monitoring for connections to known exfiltration endpoints on port 80

Affected and fixed versions

• Eclipse Foundation — Open VSX Registry
  Vulnerable versions: All — 72 malicious extensions published
  Fixed in: Malicious extensions removed
• Microsoft — Visual Studio Code Marketplace
  Vulnerable versions: All — cline-ai-main.cline-ai-agent v3.1.3 confirmed malicious
  Fixed in: Extension removed
• GitHub — GitHub Repositories
  Vulnerable versions: 151+ repositories injected March 3-9, 2026
  Fixed in: Cleanup ongoing
• npm — npm Registry
  Vulnerable versions: @aifabrix/miso-client v4.7.2, @iflow-mcp/watercrawl-watercrawl-mcp v1.3.0-1.3.4
  Fixed in: Packages removed

Timeline of GlassWorm v3 ZOMBI module

• 2025-03-01 Initial Unicode-based npm malware attacks using Private Use Area encoding first identified by security researchers
• 2025-10-17 Koi Security identifies seven compromised OpenVSX extensions distributing locked-ioc-24 (35,800 cumulative downloads) — first wave
• 2025-10-19 Malicious extension locked-ioc-14 v3.1.3 detected on Microsoft VS Code Marketplace, still active two days after initial detection
• 2025-10-31 GitHub repository infections identified — locked-ioc-24 begins injecting invisible Unicode payloads into open-source repositories
• 2026-01-15 locked-ioc-24 pivots to macOS targeting, distributing malicious VS Code extensions with AES-256-CBC encrypted payloads and LaunchAgent persistence
• 2026-01-30 Compromised developer account 'oorzc' used to push malicious updates to four established Open VSX extensions (22,000+ combined downloads) — second wave
• 2026-01-31 72 additional malicious Open VSX extensions discovered using extensionPack and extensionDependencies abuse for transitive payload delivery
• 2026-02-02 Three malicious oorzc extensions remain available on Open VSX marketplace despite reports, later removed
• 2026-03-03 Third wave begins: mass GitHub repository injection campaign starts, targeting 151+ repositories with AI-generated camouflage commits
• 2026-03-09 Aikido Security publishes detailed analysis of locked-ioc-24 v3 Unicode injection campaign across GitHub, npm, and VS Code ecosystems
• 2026-03-12 locked-ioc-25 botnet module fully analyzed — confirmed capabilities include HVNC, SOCKS proxy, cryptocurrency wallet draining of 49 wallet types, and P2P botnet networking
• 2026-03-14 The Hacker News and Fluid Attacks publish comprehensive analyses of the locked-ioc-24 v3 campaign scope and locked-ioc-25 module capabilities
• 2026-05-29 As of 2026-05-29, locked-ioc-24 v3 (actor PhantomRaven) is no longer active: on May 26, 2026 CrowdStrike, Google and Shadowserver simultaneously severed all four C2 channels (Solana, BitTorrent DHT, Google Calendar, VPS), and infected hosts now beacon to a benign sinkhole. It is dormant, not resolved, since the malware persists on compromised endpoints and operators are not confirmed arrested.

Sources cited for GlassWorm v3 ZOMBI module

• Glassworm Returns: Invisible Unicode Malware Hits GitHub, npm, VS Code — Aikido Security aikido.dev · Research · 2026-03-09
• GlassWorm Supply Chain Analysis — Fluid Attacks fluidattacks.com · Research · 2026-03-14
• GlassWorm: First Self-Propagating Worm Using Invisible Code — Koi Security koi.ai · Research · 2025-10-17
• GlassWorm Self-Propagating VSCode Extension Worm — Truesec truesec.com · Research · 2025-10-19
• GlassWorm on macOS: Malicious VS Code Extensions via Solana — SOC Prime socprime.com · Research · 2026-01-15
• Defending Against Glassworm — Snyk snyk.io · Vendor report · 2026-03-13
• GlassWorm Supply Chain Worm Uses Invisible Unicode and Solana Blockchain — Security Online securityonline.info · Blog · 2026-03-10
• GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions — The Hacker News The Hacker News · News · 2026-03-14
• Open VSX Supply Chain Attack: Compromised Developer Account — The Hacker News The Hacker News · News · 2026-02-28
• Self-Spreading GlassWorm Infects VS Code Extensions — The Hacker News The Hacker News · News · 2025-10-19
• Glassworm Malware Returns in Third Wave — BleepingComputer BleepingComputer · News · 2026-03-12
• Self-Propagating GlassWorm Poisons VS Code Extensions — Dark Reading Dark Reading · News · 2025-10-20

Threats related to GlassWorm v3 ZOMBI module

• GlassWorm Supply Chain Campaign: 73 Malicious Open VSX Extensions Using Transitive Dependencies
• GlassWorm Supply Chain Attack: Fake Browser Extension & Multi-Stage RAT via Compromised Developer Packages
• GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS)
• Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant LockBit 3.0 Loader, Adopted by FSB's Secret Blizzard Against Ukrainian Military

Related coverage of this activity

• InvisibleFerret Cython campaign

Previous and next in malware

• Hive0163 Slopoly AI-Generated Backdoor and Interlock Ransomware Campaign Previous report
• Konni APT Spear-Phishing Campaign Abuses KakaoTalk to Deploy EndRAT, RftRAT, RemcosRAT Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages