From IDE To Initial Access: Hunting Malicious VS Code Extensions (GlassWorm, WhiteCobra & Copycats)

27 November 2025by Threat Hunting Team

Malicious Visual Studio Code (VS Code) extensions are being used to steal developer credentials, target crypto assets, and even stage hands-on-keyboard access through IDEs. Recent waves (e.g., GlassWorm and WhiteCobra) show that attackers can weaponize trusted marketplaces and auto-updates to move upstream, right into the tools developers use every day. This blog explains what’s happening, who’s affected, and how to hunt and contain it in enterprise environments.

Table of Contents

Impacted Technologies

Why This Is Important

How Wizard Cyber Can Help

References

Technical Details

Threat Overview

Campaigns: Families like GlassWorm (self-propagating via extension ecosystems) and WhiteCobra (multi-editor waves) demonstrate sustained abuse of official marketplaces and VSIX side-loads.
Objectives: Credential harvesting (GitHub/NPM tokens), theft of browser-stored secrets and crypto wallets, local proxying/beacons, and in isolated cases: ransomware-like file operations.
Targets: Developer workstations and build helpers (VS Code, Cursor, Windsurf/Open VSX consumers) across Windows, macOS, and Linux.

Technical Analysis

Attack chain (typical):

Initial foothold: User installs/updates an extension from Marketplace/Open VSX or side-loads a .vsix.
Activation hooks: On install/startup/open-workspace events, the extension executes script code.
Post-activation behavior: Spawns node/python/powershell/curl, touches token files (NPM_TOKEN, GITHUB_TOKEN) and browser DBs, optionally sets up SOCKS/hidden desktop sharing, and beacons to web services (webhooks/CDN/paste).
Evasion: Benign-looking names, republished IDs, and Unicode/obfuscation tricks.
Scale factor: Publisher/marketplace token leaks and auto-update mechanisms can distribute a bad update quickly.

Threat Hunting Overview

Hunting Hypothesis
Malicious VS Code extensions associated with current campaigns (e.g., GlassWorm, WhiteCobra, and the “susvsex” ransomware-like add-on) were installed or updated in our environment during the last 30 days.

If true, endpoints will show vsce-sign verification events for known publisher.name@version pairs (or any-version IDs flagged by advisories), followed by short-lived Code -> script/tool child processes and, in some cases, credential or data exfiltration behaviors.
What we expect to see if the hypothesis is TRUE
- Install/update evidence: DeviceProcessEvents with ProcessCommandLine containing vsce-sign and a cached VSIX path like …\CachedExtensionVSIXs\<publisher.name>-<version>-…, matching our bad_versions table or the any-version fallback IDs.
- Immediate post-activation activity: code(.exe) spawning node/python/powershell/curl within ~60 – 120 seconds of the verify event (credential theft, token access, downloader beacons). GlassWorm waves have repeatedly shown this pattern and follow-on exfil/tooling.
- Network touches: Marketplace/Open VSX/CDN fetches around install time, and (for some families) beacons to webhooks, paste services, or proxy/VNC infrastructure.
- High-risk families:
  - GlassWorm waves (Open VSX and Marketplace) – credential theft, crypto-wallet targeting, SOCKS/hidden VNC; new IDs/versions continue to appear.
  - WhiteCobra – dozens of crypto-stealing extensions seeded across VS Code/Cursor/Windsurf; advisories often flag IDs without pinning a version (use your bad_ids_any).
  - “susvsex” ransomware-like extension briefly on the official marketplace; treat any presence of suspublisher18.susvsex as critical.
What we expect to see if the hypothesis is FALSE
- No vsce-sign verifications matching bad_versions or bad_ids_any in the last 30 days, and no correlated short-window code -> node/powershell/curl chains on non-dev endpoints.
Pivots to run on any hit (quick triage)
- Process tree: enumerate children of code(.exe) within 120s of the verify event; note commands that touch token files (NPM_TOKEN, GITHUB_TOKEN) or browser stores. (GlassWorm waves used token theft & wallet targeting.)
- Network: pivot from the same host/time window into DeviceNetworkEvents for marketplace/OpenVSX/CDN pulls and any webhooks/paste endpoints.
- Filesystem: check %USERPROFILE%\.vscode\extensions\publisher.name-version\ creation/write events to confirm the installed artifact.
- Scope: summarize by extension ID/version and by host to prioritize containment.
Hunting Query:
Example Query that uses public malicious extensions that checks for both specific version and any version of the malicious extensions based on security advisories for initial access evidence only:

Indicators of Compromise:

Core infrastructure & payload IOCs

IOC Type	Indicator	Context / Use
IP (C2)	217.69.3[.]218	Primary C2 server
URL (exfil)	140.82.52[.]31:80/wall	Exfiltration endpoint
Solana wallet	28PKnu7Rziz[x]BzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2	Blockchain C2 wallet used to post instructions
Solana transaction	49CDiVWZpuS[W]1b2HpzweMgePNg15dckgmqrrmpihYXJMYRsZvumVtFsDim1keESPCrKcW2CzYjN3nSQDGG14KKFM	Example on-chain instruction carrier
Google Calendar C2	https://calendar[.]app.google/M2ZCvM8ULL56PD1d6	Backup C2
Email (Calendar organizer)	uhjdclolkdn@gmail[.]com	Organizer of Calendar C2
Payload URL	http://217.69.3[.]218/qQD%2FJoi3WCWSk8ggGHiTdg%3D%3D	Hosted payload
Payload URL	http://217.69.3[.]218/get_arhive_npm/	Archive fetch
Payload URL	http://217.69.3[.]218/get_zombi_payload/qQD%2FJoi3WCWSk8ggGHiTdg%3D%3D	ZOMBI module fetch
Persistence (Registry)	HKCU\Software\Microsoft\Windows\CurrentVersion\Run	Auto-start
Persistence (Registry)	HKLM\Software\Microsoft\Windows\CurrentVersion\Run	Auto-start (machine-wide)

Additional infrastructure seen in other reports

IOC Type Indicator Context / Use

IP (C2) 199.247.10[.]166 Alternate/secondary C2

URL (exfil) 199.247.13[.]106:80/wall Alternate exfil endpoint

IOC Type	Indicator	Context / Use
IP (C2)	199.247.10[.]166	Alternate/secondary C2
URL (exfil)	199.247.13[.]106:80/wall	Alternate exfil endpoint

Malicious extensions (exact versions)

IOC Type	Indicator	Context / Use
VS Code / OpenVSX	codejoy.codejoy-vscode-extension@1.8.3	Compromised build
VS Code / OpenVSX	codejoy.codejoy-vscode-extension@1.8.4	Compromised build
VS Code / OpenVSX	l-igh-t.vscode-theme-seti-folder@1.2.3	Compromised build
VS Code / OpenVSX	kleinesfilmroellchen.serenity-dsl-syntaxhighlight@0.3.2	Compromised build
VS Code / OpenVSX	jscearcy.rust-doc-viewer@4.2.1	Compromised build
VS Code / OpenVSX	sirilmp.dark-theme-sm@3.11.4	Compromised build
VS Code / OpenVSX	codeinklingon.git-worktree-menu@1.0.9	Compromised build
VS Code / OpenVSX	codeinklingon.git-worktree-menu@1.0.91	Compromised build
VS Code / OpenVSX	ginfuru.better-nunjucks@0.3.2	Compromised build
VS Code / OpenVSX	ellacrity.recoil@0.7.4	Compromised build
VS Code / OpenVSX	grrrck.positron-plus-1-e@0.0.71	Compromised build
VS Code / OpenVSX	jeronimoekerdt.color-picker-universal@2.8.91	Compromised build
VS Code / OpenVSX	srcery-colors.srcery-colors@0.3.9	Compromised build
VS Code / OpenVSX	sissel.shopify-liquid@4.0.1	Compromised build
VS Code / OpenVSX	TretinV3.forts-api-extention@0.3.1	Compromised build
VS Code Marketplace	cline-ai-main.cline-ai-agent@3.1.3	Malicious on MS marketplace (reported)

MITRE ATT&CK Mapping

T1195 – Supply Chain Compromise
T1059 – Command & Scripting Interpreter (JavaScript/Node, PowerShell, Bash)
T1105 – Exfiltration over Web Services / Application Layer Protocol
T1078 – Valid Accounts (abused developer/publisher tokens)
T1555 / T1217 – Credentials from Password Stores / Browser Credential Access
T1036 – Masquerading (benign names/themes)

Prevention

Extension governance:
- Allow-list approved publishers; restrict .vsix side-loads on non-dev endpoints.
- Require review/approval for new publishers and suspicious permission scopes.
Secret & publisher hygiene:
- Treat Marketplace/Open VSX publisher tokens as production secrets (scoped, rotated, monitored).
- Scan repos/CI for leaked tokens and sensitive strings.
Network controls:
- Egress allow-list from dev endpoints/CI; alert on webhooks/paste/CDN destinations invoked by code.exe.
Identity hardening:
- Enforce phishing-resistant MFA for GitHub/NPM; enable commit signing and secret scanning.
Segmentation & hardening:
- Separate developer endpoints; baseline normal Code -> Node/Python activity for sanctioned tools.

Remediation

Contain: Isolate host; capture process tree (Code -> child), list installed extensions, and collect network indicators.
Credential reset: Revoke/rotate affected tokens (GitHub/NPM/cloud), invalidate browser sessions.
Eradicate: Remove suspect extensions; clear caches/auto-update artifacts; temporarily disable extension auto-update while you validate the fleet.
Block & retro-hunt: Block observed destinations; hunt 14 – 30 days across endpoints and proxies.
Recover: Reset browser profiles/wallets if accessed; verify no residual proxies/remote-control modules.

Trends & Impact

Continuous waves: New IDs appear as fast as older ones are removed; attackers rebrand and republish.
Supply-chain blast radius: Auto-updates and publisher token abuse make extension fleets a high-leverage distribution channel.
Cross-tooling: Activity spans VS Code and compatible editors that consume the same ecosystems.

Impacted Technologies

Editors: VS Code and Open VSX consumers (Cursor, Windsurf, VSCodium).
Services & data: GitHub and NPM tokens; Chromium-based browser stores; local source code and workspace secrets.

Why This Is Important

Developer machines are upstream of your applications and CI/CD. A single rogue extension can yield source-code theft, secret exposure, financial loss, and downstream compromise, without tripping traditional email/web gateways, because abuse happens inside trusted tools and auto-update channels. Treat the IDE as a first-class security surface and monitor it like any other production workload.

How Wizard Cyber Can Help

Purpose-built threat hunting and response for malicious IDE extensions (GlassWorm, WhiteCobra & copycats), aligned to our TH SOP and your SDLC.

IOC-Driven Hunts
- We proactively search your environment for known bad extensions and related signals, then report scope and recommended containment.
TTP-Driven Hunts
- We run recurring, behavior-based hunts designed to catch malicious IDE activity even when names or versions change.
Daily Automated Threat Hunting
- We perform scheduled, daily checks for IDE threats and deliver clear “results/no-results” updates, escalating anything suspicious.
Unstructured Monthly Hunts
- Each month we investigate emerging campaigns and copycats, document what we find, and advise on next steps.
Managed Detection & Response (Defender XDR)
- 24/7 monitoring and response: we triage alerts, contain affected machines, remove malicious extensions, and guide rapid recovery.

References

CYBERSECURITY READINESS

Strengthen Your Cyber Defences Today

As cyber threats grow more complex, proactive detection is no longer optional.

With Wizard Cyber’s Microsoft expertise, organizations can transform their security posture and gain real-time visibility across all endpoints.

Start your journey to smarter, faster cybersecurity today.

EXPLORE MORE

Related Blogs & Insights

Discover blogs that deepen your knowledge and accelerate your security strategy.

CoPhish – New Phishing Technique Using CoPilot

CoPhish uses Copilot Studio to steal OAuth tokens via trusted Microsoft domains. Learn how the attack works and how to defend against it.

Trusted Services As Phishing Vectors: Techniques, Evasion, And Defensive Controls

Learn how attackers exploit trusted services for phishing and how Wizard Cyber detects and defends against these subtle threats.

Evading Detection: The Hidden Tricks Behind Today’s Phishing Attacks – Part1

Discover how attackers use obfuscation, JavaScript tricks, and click-fix tactics to bypass security and enhance phishing campaigns.

Mustafa Alshawwa & Farah Qamhawi

Threat Hunting Team

The Threat Hunting Team at Wizard Cyber is focused on proactively seeking out advanced threats that evade traditional security measures. Leveraging advanced analytics and deep knowledge of threat actor behavior, they uncover hidden risks within our clients' environments. This team's continuous monitoring and analysis ensure that any potential compromises are detected and neutralized before they escalate.

Securing the Digital Bank: how MXDR solution protects financial workloads 24x7x365

Trusted Services as Phishing Vectors: Techniques, Evasion, and Defensive Controls

WIZARD CYBER