# GlassWorm v3 Supply Chain Attack — 72 Malicious Open VSX Extensions, 151 GitHub Repos & ZOMBI Botnet Module

> GlassWorm v3 is a self-propagating supply chain worm that compromised 72 Open VSX extensions, injected invisible Unicode-encoded payloads into 151+ GitHub repositories, and deploys the ZOMBI RAT module — transforming developer workstations into botnet nodes for credential theft, cryptocurrency wallet draining, and SOCKS proxy abuse. The campaign uses a triple-layer C2 architecture combining Solana blockchain dead-drop resolvers, direct IP connections, and Google Calendar fallback channels.

- **Published:** 2026-03-15T12:00:00Z
- **Last reviewed:** 2026-03-15T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0231
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-glassworm-v3-zombi-module-tl-2026-0231.webp?v=2628a4f2 (Threadlinqs threat intel: GlassWorm v3 Hits 151 GitHub Repos: Detection & IOCs (TL-2026-0231) — High severity, 25 IOCs, 9 detection rules.)
- **ID:** TL-2026-0231
- **Severity:** HIGH (CVSS 8.6)
- **Category:** MALWARE
- **Status:** DORMANT
- **Actor:** PhantomRaven (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)

## Description

GlassWorm v3 represents a significant escalation of the GlassWorm supply chain campaign first identified in March 2025. The third wave, active from January through March 2026, abuses Open VSX extensionPack and extensionDependencies fields to create transitive delivery vehicles that pull malicious payloads after trust is established.

The attack chain begins with benign-appearing extensions published to the Open VSX marketplace and VS Code Marketplace. These extensions mimic popular developer utilities including linters, formatters, code runners, and AI-powered coding assistants (impersonating tools like Claude Code and Google Antigravity). Post-publication updates introduce malicious dependencies through extensionPack exploitation and Remote Dynamic Dependencies (RDD) via custom HTTP URLs in package.json.

The obfuscation layer uses Private Use Area (PUA) Unicode characters in the ranges 0xFE00-0xFE0F (variation selectors) and 0xE0100-0xE01EF (supplementary markers) to encode malicious payloads as invisible characters. The injection appears as empty backtick blocks but contains hidden character sequences that decode to full malicious loaders executed via eval(). Surrounding changes are AI-generated and realistic — documentation tweaks, version bumps, small refactors, and bug fixes — making detection extremely difficult.

The C2 infrastructure employs a triple-layer resilience architecture: (1) Solana blockchain transactions serve as dead-drop resolvers — the wallet 28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2 stores C2 addresses in transaction memos that cannot be taken down; (2) direct IP connections to 217.69.3.218 and 199.247.10.166 for payload delivery; (3) Google Calendar (calendar.app.google/M2ZCvM8ULL56PD1d6) as a fallback C2 channel.

The final payload is the ZOMBI module — a massive JavaScript RAT that transforms infected developer workstations into criminal infrastructure nodes. ZOMBI capabilities include: credential harvesting (NPM tokens, GitHub tokens, Open VSX credentials, Git credentials, AWS keys, SSH keys), cryptocurrency wallet draining targeting 49 wallet extensions (MetaMask, Coinbase Wallet, Phantom, Electrum, Exodus, Atomic, Ledger, Trezor, Binance, TonKeeper), hidden VNC (HVNC) for invisible remote desktop access, SOCKS proxy for routing traffic through corporate networks, and WebRTC/BitTorrent networking for P2P botnet communication.

The malware performs locale checks to avoid infecting systems with a Russian locale, suggesting Russian-speaking actors. Attribution points to 'PhantomRaven' — an entity that deliberately rotated account names and email addresses to evade tracking. The campaign evolved through four waves: initial Unicode npm attacks (March 2025), first OpenVSX compromise (October 2025), compromised developer account attack (January 2026), and the current mass injection campaign (March 2026).

The GitHub injection campaign (March 3-9, 2026) targeted 151+ repositories including projects with significant star counts (pedronauck/reworm with 1,460 stars). The malware includes a 15-minute execution delay before decrypting and running an AES-256-CBC JavaScript payload, evading sandbox analysis. Persistence mechanisms include Windows Registry Run keys (HKCU and HKLM) and macOS LaunchAgents. Data is staged in /tmp/ijewf/ before exfiltration to 140.82.52.31:80/wall and 199.247.13.106:80/wall.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1176 Software Extensions
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1614 System Location Discovery
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1074 Data Staged
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1008 Fallback Channels
- T1571 Non-Standard Port
- T1219 Remote Access Tools
- T1102 Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1496 Resource Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GlassWorm v3 — Malicious VS Code Extension Payload Execution** (`TL-2026-0231-SPL-001`)

Detects VS Code extension host process spawning child processes with command line patterns indicative of GlassWorm v3 payload execution, including eval() calls on decoded Unicode payloads, AES-256-CBC decryption routines, 15-minute sandbox evasion delays (setTimeout 900000), and known GlassWorm URI path references. Targets the initial exploitation phase where a malicious Open VSX or VS Code Marketplace extension activates and executes the invisible Unicode-encoded JavaScript loader.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1059.007, T1027
- **Data sources:** sysmon, windows_security, microsoft_defender_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(ParentImage="*\\Code.exe" OR ParentImage="*\\code" OR ParentCommandLine="*extensionHost*")
(Image="*\\node.exe" OR Image="*\\cmd.exe" OR Image="*\\powershell.exe")
| eval suspicious=if(match(CommandLine, "(?i)(eval\(|Function\(|fromCharCode|setTimeout.*900000|AES|decrypt|get_zombi|get_arhive|ijewf|\\xFE0|\\uFE0)"), 1, 0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands by Computer, User, ParentImage, Image
| where count > 0
| table Computer, User, ParentImage, Image, commands, count, first_seen, last_seen
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "Code.exe" or InitiatingProcessCommandLine has "extensionHost"
| where FileName in~ ("node.exe", "cmd.exe", "powershell.exe")
| where ProcessCommandLine has_any ("eval(", "Function(", "fromCharCode", "setTimeout", "900000", "get_zombi", "get_arhive", "ijewf", "\\xFE0", "\\uFE0", "AES", "decrypt")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Commands=make_set(ProcessCommandLine) by DeviceName, AccountName, FileName
```

### Sigma

```yaml
title: GlassWorm v3 Malicious VS Code Extension Payload Execution
id: 48d7fc66-de25-4eef-b0a9-e015ace6c032
status: experimental
description: Detects VS Code extension host spawning child processes with command line patterns indicative of GlassWorm v3 Unicode-decoded payload execution via eval(), AES decryption, or sandbox evasion delays
references:
    - https://intel.threadlinqs.com/threat/TL-2026-0231
    - https://thehackernews.com/2026/03/glassworm-supply-chain-attack-abuses-72.html
    - https://www.aikido.dev/blog/glassworm-returns-unicode-attack-github-npm-vscode
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/03/15
tags:
    - attack.initial_access
    - attack.t1195.002
    - attack.execution
    - attack.t1059.007
    - attack.defense_evasion
    - attack.t1027
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\\Code.exe'
            - '\\code'
    selection_parent_cmdline:
        ParentCommandLine|contains: 'extensionHost'
    selection_child:
        Image|endswith:
            - '\\node.exe'
            - '\\cmd.exe'
            - '\\powershell.exe'
    selection_suspicious:
        CommandLine|contains:
            - 'eval('
            - 'Function('
            - 'fromCharCode'
            - 'setTimeout'
            - '900000'
            - 'get_zombi'
            - 'get_arhive'
            - 'ijewf'
    condition: (selection_parent or selection_parent_cmdline) and selection_child and selection_suspicious
falsepositives:
    - Legitimate VS Code extensions using eval() for code transformation or transpilation
    - Development tools with intentionally obfuscated code
level: high
```

**Known false positives:**

- Legitimate VS Code extensions using eval() for code transformation
- Development tools with intentionally obfuscated code

**Tuning notes:** Exclude known legitimate extensions by adding ParentCommandLine exclusions for trusted extension IDs. Adjust setTimeout threshold if legitimate extensions use long delays. Add allowlist for internal developer tooling that uses eval().

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- GlassWorm v3 — Unicode PUA Character Injection in Source Code Files (locked: unlock with TL Creds)
- GlassWorm v3 — Developer Credential File Access by Non-Standard Process (locked: unlock with TL Creds)
- GlassWorm v3 — Solana Dead-Drop Resolver and Google Calendar Fallback C2 (locked: unlock with TL Creds)
- GlassWorm v3 — Malicious npm/Extension Package Installation with Remote Dynamic Dependencies (locked: unlock with TL Creds)
- GlassWorm v3 — ZOMBI Data Staging in Temporary Directory (locked: unlock with TL Creds)
- GlassWorm v3 — ZOMBI SOCKS Proxy, HVNC, and P2P Botnet Activity (locked: unlock with TL Creds)
- GlassWorm v3 — ZOMBI Module Registry and LaunchAgent Persistence (locked: unlock with TL Creds)
- GlassWorm v3 — C2 Communication to Known Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- IP address: `217.69.3[.]218`
- URL: `hxxps://calendar[.]app[.]google/M2ZCvM8ULL56PD1d6`
- Email address: `uhjdclolkdn[@]gmail[.]com`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions — The Hacker News](https://thehackernews.com/2026/03/glassworm-supply-chain-attack-abuses-72.html)
- [Glassworm Returns: Invisible Unicode Malware Hits GitHub, npm, VS Code — Aikido Security](https://www.aikido.dev/blog/glassworm-returns-unicode-attack-github-npm-vscode)
- [GlassWorm Supply Chain Analysis — Fluid Attacks](https://fluidattacks.com/blog/glassworm-vs-code-extensions-supply-chain-attack)
- [Open VSX Supply Chain Attack: Compromised Developer Account — The Hacker News](https://thehackernews.com/2026/02/open-vsx-supply-chain-attack-used.html)
- [GlassWorm: First Self-Propagating Worm Using Invisible Code — Koi Security](https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace)
- [GlassWorm Self-Propagating VSCode Extension Worm — Truesec](https://www.truesec.com/hub/blog/glassworm-self-propagating-vscode-extension)
- [Self-Spreading GlassWorm Infects VS Code Extensions — The Hacker News](https://thehackernews.com/2025/10/self-spreading-glassworm-infects-vs.html)
- [GlassWorm on macOS: Malicious VS Code Extensions via Solana — SOC Prime](https://socprime.com/active-threats/glassworm-analysis/)
- [GlassWorm Supply Chain Worm Uses Invisible Unicode and Solana Blockchain — Security Online](https://securityonline.info/glassworm-supply-chain-worm-uses-invisible-unicode-and-solana-blockchain-for-stealth-c2/)
- [Glassworm Malware Returns in Third Wave — BleepingComputer](https://www.bleepingcomputer.com/news/security/glassworm-malware-returns-in-third-wave-of-malicious-vs-code-packages/)
- [Self-Propagating GlassWorm Poisons VS Code Extensions — Dark Reading](https://www.darkreading.com/application-security/self-propagating-glassworm-vs-code-supply-chain)
- [Defending Against Glassworm — Snyk](https://snyk.io/articles/defending-against-glassworm/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0231