Скачать или смотреть Malware Just Hijacked 22,000 Macs Through a VS Code Backdoor

Thousands of macOS developers may have unknowingly compromised their systems after four widely-used Visual Studio Code extensions were trojanized to steal credentials and personal data. A revived version of the GlassWorm malware was discovered hiding in official OpenVSX extension packages, downloaded over 22,000 times. This incident isn’t just another supply chain risk — it’s a targeted campaign with urgent implications for cross-platform developers and teams managing shared environments.

In this video, we break down the GlassWorm malware’s return, how it leveraged real developer credentials to infiltrate the ecosystem, and why macOS users are in the crosshairs. We examine the four affected extensions (oorzc.ssh-tools, i18n-tools-plus, mind-map, scss-to-css-compile), explain how the attack works, and provide immediate response steps for developers, teams, and organizations. This incident stands out for its stealth, targeting, and technical sophistication — including malware updates triggered via Solana blockchain data.

*Key Points Unpacked:*
1. GlassWorm malware hid inside four VS Code extensions on the OpenVSX registry.
2. It activates at login, uses LaunchAgents for persistence, and avoids detection by checking system settings.
3. The malware exfiltrates credentials, browser data, crypto wallets, Apple Notes, and entire macOS Keychains.
4. Updates are pulled encrypted through the Solana blockchain — a rare and concerning delivery method.
5. Russian locales are excluded, suggesting origin and future targeting trends.

*Why This Matters To You:*
Even if you’re a solo developer or a small dev team, trojanized tools can compromise your credentials, cloud tokens, and sensitive files. The malware is designed to reach broadly across environments by stealing synced credentials — putting both personal data and organizational infrastructure at risk. Quick detection, revoking tokens, rotating secrets, and scanning your system can prevent further damage.

*How Secursky Helps:*
Secursky monitors and analyzes emerging cyber threats like this to keep your organization ahead of attacks. We turn complex threat intelligence into clear guidance, helping teams reduce exposure, streamline response, and stay informed in real time.

Review our website: https://secursky.com
Check out our other socials: LinkedIn
Get in touch: [email protected]

This is a real-world reminder of how trusted ecosystems can be abused. If you used any of the affected extensions before January 30, take immediate remediation steps. Don’t wait for signs — act now, and stay ahead of the next threat.

#cybersecurity #macOSmalware #vsCode #GlassWorm #supplychainattack #developersafety #digitalrisk #infosecnews