{"id":12408,"date":"2026-04-26T10:04:21","date_gmt":"2026-04-26T10:04:21","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/04\/26\/73-open-vsx-sleeper-extensions-linked-to-glassworm-activate-new-malware-campaign\/"},"modified":"2026-04-26T10:04:21","modified_gmt":"2026-04-26T10:04:21","slug":"73-open-vsx-sleeper-extensions-linked-to-glassworm-activate-new-malware-campaign","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/04\/26\/73-open-vsx-sleeper-extensions-linked-to-glassworm-activate-new-malware-campaign\/","title":{"rendered":"73 Open VSX Sleeper Extensions Linked to GlassWorm Activate New Malware Campaign"},"content":{"rendered":"

73 Open VSX Sleeper Extensions Linked to GlassWorm Activate New Malware Campaign
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

The GlassWorm supply chain attack<\/a> targeting the Open VSX marketplace has escalated with the discovery of 73 new \u201csleeper\u201d extensions.<\/p>\n

Identified in April 2026, this cluster marks a dangerous shift in how threat actors distribute malware to software developers.<\/p>\n

This activity follows a major wave discovered in March 2026, where researchers documented 72 malicious Open VSX extensions<\/a> tied to the GlassWorm operation.<\/p>\n

Earlier variants abused extension dependency features to install malicious loaders silently. However, the new April 2026 cluster shows that attackers are evolving their tactics to evade security scans.<\/p>\n

The Sleeper Extension Strategy<\/strong><\/h2>\n

A sleeper extension is a fake package published by threat actors before it is weaponized. These extensions initially appear harmless to build visual trust, gain credibility, and gather downloads.<\/p>\n

Attackers use newly created GitHub accounts to publish cloned versions of popular tools.<\/p>\n

For example, attackers created a fake Turkish Language Pack for Visual Studio Code<\/a> that closely mimicked the legitimate version. They copied the globe icon and the description, while simply swapping the publisher name.<\/p>\n

\"A
A fake Turkish language pack for Visual Studio Code(source :socket)<\/figcaption><\/figure>\n

Once developers install these cloned tools, the attackers wait before pushing a software update that delivers the malware. At least six of the 73 new extensions have already been activated to deliver payloads.<\/p>\n

Evolving Delivery Mechanisms<\/strong><\/h2>\n

In this latest wave, the extension acts only as a thin loader to fetch external payloads.<\/p>\n

The malicious code is no longer directly visible in the extension\u2019s source code, increasing the likelihood of evading detection<\/a>.<\/p>\n

The campaign uses two primary execution methods:<\/p>\n