GlassWorm v3 Supply Chain Attack — 72 Malicious Open VSX Extensions, 151 GitHub Repos & ZOMBI Botnet Module
GlassWorm v3 Supply Chain Attack (TL-2026-0231), also tracked as GlassWorm v3, is a high-severity malware campaign scored CVSS 8.6, first published 2026-03-15. It is attributed to PhantomRaven (Russia) with medium confidence, affects Eclipse Foundation Open VSX Registry, maps to 21 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-0231
- Threat ID
- TL-2026-0231
- Also known as
- GlassWorm v3, GlassWorm, ZOMBI RAT, Operation GlassWorm
- Severity
- HIGH
- CVSS
- 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)
- Status
- DORMANT
- Category
- MALWARE
- First published
- 2026-03-15
- Last reviewed
- 2026-03-15
- Attribution
- PhantomRaven
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, financial, cryptocurrency, open-source
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in GlassWorm v3 Supply Chain Attack
Malware and tooling: GlassWorm, ZOMBI, 28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2, 49CDiVWZpuSW1b2HpzweMgePNg15dckgmqrrmpihYXJMYRsZvumVtFsDim1keESPCrKcW2CzYjN3nSQDGG14KKFM
GlassWorm v3 is a self-propagating supply chain worm that compromised 72 Open VSX extensions, injected invisible Unicode-encoded payloads into 151+ GitHub repositories, and deploys the ZOMBI RAT module — transforming developer workstations into botnet nodes for credential theft, cryptocurrency wallet draining, and SOCKS proxy abuse. The campaign uses a triple-layer C2 architecture combining Solana blockchain dead-drop resolvers, direct IP connections, and Google Calendar fallback channels.
How GlassWorm v3 Supply Chain Attack works
GlassWorm v3 represents a significant escalation of the GlassWorm supply chain campaign first identified in March 2025. The third wave, active from January through March 2026, abuses Open VSX extensionPack and extensionDependencies fields to create transitive delivery vehicles that pull malicious payloads after trust is established.
The attack chain begins with benign-appearing extensions published to the Open VSX marketplace and VS Code Marketplace. These extensions mimic popular developer utilities including linters, formatters, code runners, and AI-powered coding assistants (impersonating tools like Claude Code and Google Antigravity). Post-publication updates introduce malicious dependencies through extensionPack exploitation and Remote Dynamic Dependencies (RDD) via custom HTTP URLs in package.json.
The obfuscation layer uses Private Use Area (PUA) Unicode characters in the ranges 0xFE00-0xFE0F (variation selectors) and 0xE0100-0xE01EF (supplementary markers) to encode malicious payloads as invisible characters. The injection appears as empty backtick blocks but contains hidden character sequences that decode to full malicious loaders executed via eval(). Surrounding changes are AI-generated and realistic — documentation tweaks, version bumps, small refactors, and bug fixes — making detection extremely difficult.
The C2 infrastructure employs a triple-layer resilience architecture: (1) Solana blockchain transactions serve as dead-drop resolvers — the wallet 28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2 stores C2 addresses in transaction memos that cannot be taken down; (2) direct IP connections to 217.69.3.218 and 199.247.10.166 for payload delivery; (3) Google Calendar (calendar.app.google/M2ZCvM8ULL56PD1d6) as a fallback C2 channel.
The final payload is the ZOMBI module — a massive JavaScript RAT that transforms infected developer workstations into criminal infrastructure nodes. ZOMBI capabilities include: credential harvesting (NPM tokens, GitHub tokens, Open VSX credentials, Git credentials, AWS keys, SSH keys), cryptocurrency wallet draining targeting 49 wallet extensions (MetaMask, Coinbase Wallet, Phantom, Electrum, Exodus, Atomic, Ledger, Trezor, Binance, TonKeeper), hidden VNC (HVNC) for invisible remote desktop access, SOCKS proxy for routing traffic through corporate networks, and WebRTC/BitTorrent networking for P2P botnet communication.
The malware performs locale checks to avoid infecting systems with a Russian locale, suggesting Russian-speaking actors. Attribution points to 'PhantomRaven' — an entity that deliberately rotated account names and email addresses to evade tracking. The campaign evolved through four waves: initial Unicode npm attacks (March 2025), first OpenVSX compromise (October 2025), compromised developer account attack (January 2026), and the current mass injection campaign (March 2026).
The GitHub injection campaign (March 3-9, 2026) targeted 151+ repositories including projects with significant star counts (pedronauck/reworm with 1,460 stars). The malware includes a 15-minute execution delay before decrypting and running an AES-256-CBC JavaScript payload, evading sandbox analysis. Persistence mechanisms include Windows Registry Run keys (HKCU and HKLM) and macOS LaunchAgents. Data is staged in /tmp/ijewf/ before exfiltration to 140.82.52.31:80/wall and 199.247.13.106:80/wall.
MITRE ATT&CK techniques used in TL-2026-0231
collection
T1005 Data from Local System; T1074 Data Staged
command-and-control
T1008 Fallback Channels; T1071 Application Layer Protocol; T1102 Web Service; T1219 Remote Access Tools; T1571 Non-Standard Port
defense-evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion
exfiltration
T1048 Exfiltration Over Alternative Protocol
execution
T1059 Command and Scripting Interpreter; T1204 User Execution
discovery
T1082 System Information Discovery; T1614 System Location Discovery
persistence
T1176 Software Extensions; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
initial-access
impact
credential-access
T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Affected products and versions in GlassWorm v3 Supply Chain Attack
- Eclipse Foundation — Open VSX Registry
Vulnerable versions: All — 72 malicious extensions published
Fixed in: Malicious extensions removed - Microsoft — Visual Studio Code Marketplace
Vulnerable versions: All — cline-ai-main.cline-ai-agent v3.1.3 confirmed malicious
Fixed in: Extension removed - GitHub — GitHub Repositories
Vulnerable versions: 151+ repositories injected March 3-9, 2026
Fixed in: Cleanup ongoing - npm — npm Registry
Vulnerable versions: @aifabrix/miso-client v4.7.2, @iflow-mcp/watercrawl-watercrawl-mcp v1.3.0-1.3.4
Fixed in: Packages removed
Remediation for GlassWorm v3 Supply Chain Attack
Immediate actions
- Audit all installed VS Code and Open VSX extensions against known malicious extension list
- Block C2 IPs at perimeter: 217.69.3.218, 199.247.10.166, 140.82.52.31, 199.247.13.106
- Search for /tmp/ijewf/ staging directory on all developer workstations
- Rotate ALL developer credentials: NPM tokens, GitHub tokens, Open VSX tokens, AWS keys, SSH keys
- Check Windows Registry Run keys and macOS LaunchAgents for unauthorized persistence
- Scan for invisible Unicode characters (PUA range 0xFE00-0xFE0F, 0xE0100-0xE01EF) in code repos
Workarounds
- Disable automatic extension updates in VS Code until audit is complete
- Pin extension versions to known-good releases
- Use VS Code extension verification via signature checking where available
- Restrict package.json from referencing external HTTP URLs
Longer-term hardening
- Implement extension allowlisting policies for VS Code and Open VSX
- Deploy EDR with behavioral detection for credential harvesting and SOCKS proxy creation
- Monitor Solana blockchain transactions for C2 dead-drop resolution patterns
- Implement package manifest auditing for Remote Dynamic Dependencies (RDD)
- Enable Unicode character visibility in code review tools and CI/CD pipelines
- Deploy network monitoring for connections to known exfiltration endpoints on port 80
Weaknesses (CWE) in GlassWorm v3 Supply Chain Attack
CWE-506, CWE-829, CWE-494, CWE-116
Timeline of GlassWorm v3 Supply Chain Attack
- Initial Unicode-based npm malware attacks using Private Use Area encoding first identified by security researchers
- Koi Security identifies seven compromised OpenVSX extensions distributing GlassWorm (35,800 cumulative downloads) — first wave
- Malicious extension cline-ai-main.cline-ai-agent v3.1.3 detected on Microsoft VS Code Marketplace, still active two days after initial detection
- GitHub repository infections identified — GlassWorm begins injecting invisible Unicode payloads into open-source repositories
- GlassWorm pivots to macOS targeting, distributing malicious VS Code extensions with AES-256-CBC encrypted payloads and LaunchAgent persistence
- Compromised developer account 'oorzc' used to push malicious updates to four established Open VSX extensions (22,000+ combined downloads) — second wave
- 72 additional malicious Open VSX extensions discovered using extensionPack and extensionDependencies abuse for transitive payload delivery
- Three malicious oorzc extensions remain available on Open VSX marketplace despite reports, later removed
- Third wave begins: mass GitHub repository injection campaign starts, targeting 151+ repositories with AI-generated camouflage commits
- Aikido Security publishes detailed analysis of GlassWorm v3 Unicode injection campaign across GitHub, npm, and VS Code ecosystems
- ZOMBI botnet module fully analyzed — confirmed capabilities include HVNC, SOCKS proxy, cryptocurrency wallet draining of 49 wallet types, and P2P botnet networking
- The Hacker News and Fluid Attacks publish comprehensive analyses of the GlassWorm v3 campaign scope and ZOMBI module capabilities
- As of 2026-05-29, GlassWorm v3 (actor PhantomRaven) is no longer active: on May 26, 2026 CrowdStrike, Google and Shadowserver simultaneously severed all four C2 channels (Solana, BitTorrent DHT, Google Calendar, VPS), and infected hosts now beacon to a benign sinkhole. It is dormant, not resolved, since the malware persists on compromised endpoints and operators are not confirmed arrested.
Sources cited for GlassWorm v3 Supply Chain Attack
- GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions — The Hacker News
- Glassworm Returns: Invisible Unicode Malware Hits GitHub, npm, VS Code — Aikido Security
- GlassWorm Supply Chain Analysis — Fluid Attacks
- Open VSX Supply Chain Attack: Compromised Developer Account — The Hacker News
- GlassWorm: First Self-Propagating Worm Using Invisible Code — Koi Security
- GlassWorm Self-Propagating VSCode Extension Worm — Truesec
- Self-Spreading GlassWorm Infects VS Code Extensions — The Hacker News
- GlassWorm on macOS: Malicious VS Code Extensions via Solana — SOC Prime
- GlassWorm Supply Chain Worm Uses Invisible Unicode and Solana Blockchain — Security Online
- Glassworm Malware Returns in Third Wave — BleepingComputer
- Self-Propagating GlassWorm Poisons VS Code Extensions — Dark Reading
- Defending Against Glassworm — Snyk
Threats related to GlassWorm v3 Supply Chain Attack
- GlassWorm Supply Chain Campaign: 73 Malicious Open VSX Extensions Using Transitive Dependencies
- GlassWorm Supply Chain Attack: Fake Browser Extension & Multi-Stage RAT via Compromised Developer Packages
- GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS)
- GlassWorm Supply Chain Attack via Trojanized VS Code Extensions on Open VSX
- Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant LockBit 3.0 Loader, Adopted by FSB's Secret Blizzard Against Ukrainian Military
- Void Dokkaebi (Famous Chollima) Cython-Compiled InvisibleFerret — .pyd/.so Binary Evasion of Script-Based Detections (DPRK Contagious Interview)
Detection coverage for TL-2026-0231
As of 2026-03-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0231 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.