GlassWorm

First self-propagating worm using invisible-Unicode code; hit OpenVSX and the VS Code Marketplace, harvested NPM/GitHub/OpenVSX/Git credentials and 49 crypto wallets, and deployed the ZOMBI RAT.

Extensions: 14
Stores: OpenVSX, VS Code
Updated: 2025-10-17
Disclosed: 2025-10-17

Member extensions

14 extensions

Campaign member extensions and their current risk
Extension	Store	Reported versions	Current risk
codejoy-vscode-extensioncodejoy.codejoy-vscode-extension	OpenVSX	1.8.3, 1.8.4	65HIGH
vscode-theme-seti-folderl-igh-t.vscode-theme-seti-folder	OpenVSX	1.2.3	65HIGH
serenity-dsl-syntaxhighlightkleinesfilmroellchen.serenity-dsl-syntaxhighlight	OpenVSX	0.3.2	65HIGH
rust-doc-viewerJScearcy.rust-doc-viewer	OpenVSX	4.2.1	Unscored
dark-theme-smSIRILMP.dark-theme-sm	OpenVSX	3.11.4	65HIGH
git-worktree-menuCodeInKlingon.git-worktree-menu	OpenVSX	1.0.9, 1.0.91	65HIGH
better-nunjucksginfuru.better-nunjucks	OpenVSX	0.3.2	65HIGH
recoilellacrity.recoil	OpenVSX	0.7.4	65HIGH
positron-plus-1-egrrrck.positron-plus-1-e	OpenVSX	0.0.71	Unscored
color-picker-universaljeronimoekerdt.color-picker-universal	OpenVSX	2.8.91	51.39MEDIUM
srcery-colorssrcery-colors.srcery-colors	OpenVSX	0.3.9	65HIGH
shopify-liquidsissel.shopify-liquid	OpenVSX	4.0.1	Unscored
forts-api-extentionTretinV3.forts-api-extention	OpenVSX	0.3.1	65HIGH
cline-ai-agentcline-ai-main.cline-ai-agent	VS Code	3.1.3	Unscored

Indicators

Download STIX →

Browse 137 indicators

Type	Value & evidence
solana_wallet	28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2C2 dead-drop
ip	217.69.3.218primary C2
ip	199.247.10.166C2
ip	140.82.52.31exfil /wall
ip	199.247.13.106exfil /wall
sha256	00d7f42ce14bc4c20a5d8d79433a36b2a5ba251af63e7fab41cd23d8cd5fb138
sha256	01c8f6c1ad9dd78c27dad09b1a3cdc9dce27dfbfa1e01f2b601c1808402aa019
sha256	025216442642dddaff9d6c93cb659303bc4291ddc9d3177327c0e9c58dd2c9e1
sha256	053620962047f50a91c6e8d1a6519eccc41fab51473f033086b4d816abe8bcb0
sha256	05a3584d3b296f9007fa41911403c40d59cdd46bc5179f29b43fe226c18cca5a
sha256	06fab21dc276e3ab9b5d0a1532398979fd377b080c86d74f2c53a04603a43b1d
sha256	09bd42f47e101a0cfe5456e88b5f10b8a2426616631a4956a7454b6c17c8d2f7
sha256	0b90ede080e5fca2dc60740262932634dea6127af825c671c1dc5f384e75fe84
sha256	173e7420c9a9aa2ec9271c362a4c24b068e5bc8fceca5e036eb6abc88bd1ab0a
sha256	1997409c429dcc0a21011ca52121a8bbaf2a39bacaad31f9cf7a160a89c361aa
sha256	1d36b57e448b28a0e0d91279ef7a7849c6355d8fdb874b42a86ac9d9f90a25cf
sha256	1e5dfb51162c91d03c80c5dec50a6a5fce5194b7ee170ba09ca5fe0075bd5515
sha256	1e6487b7fbb9a0ff4c1d7032bfecd153fa6b9cc3c523243e8183588a98168267
sha256	1ed7ca5301e96e3cef201311b76ba33f842fdb34e91041177865b6e07acb7b4d
sha256	1f51780838c5ca56336645bfc6e2812f4a68b8abd6d02bf62bc308b62a583bb8
sha256	21a634d93f53c611356089ce472b3dd0fd6de5037fb98a48c8d64ac8133292ab
sha256	21dd863ff9bbd15da01c1218bf92bd65eeae04a41876e10c41733b58035414c4
sha256	22636bbb9e1f26a4ce31fa185d4a4add37580888b6376922aa364a8032490dcb
sha256	235dc9b79d455b87242482bedfc56f9def42c3976debbde6d3a4f1d998cedef0
sha256	24269ae7a306178f21a7e0b4502358d1d0931eded86c3a9caa5ea8471ba34ce3
sha256	2b2425893c83dc53fb87975a080efb361da8da37df21c157a3bb601738c608b8
sha256	2ba01d4141fce7342a7f0cc330e6c08da83cfe5d4bfd1a79b69f20d2b1f4f7e5
sha256	2f69bd40a343b14a0cdbd498ea4d673b69855bbfb77b655fdacf5327018e329a
sha256	30a1cf488aa5ff72dc76d4a9d9409b5a148c4b3a061e742f52b48348450797fd
sha256	35302b25381e53272a79b77f6600a1749ab8988faf2f74305da962413bc672b1
sha256	3a79036ce04c504a193d85ddcc34a4ca5df583a64bfff81fc0b53b03d16de6e9
sha256	3cc0a9e9f064486bf063e69be03ca65557d8182d2975185d44677b66814cdaa2
sha256	3cfa7942b9863652c7ab42d0c389e1e6ae3ec51b70d3145bf05b34564da8f101
sha256	3ee16b73ec84f6d1a448bdc6343a17d93bebe515f306ad3986729493443389be
sha256	401c125517b1f845289bf0a7a33e5db0391034f631eab85dd65b76b7fec9a959
sha256	415a4f39dd93c2ad5fd02023489352b974a9a917664240299ca4c35ca9a5a362
sha256	41caca39e0605527f6124e18902b8719131b1e13531fa5b71da4020ea6b9e1a7
sha256	43253a888417dfab034f781527e08fb58e929096cb4ef69456c3e13550cb4e9e
sha256	442ae757a5d2aa698693fd95862680ac2ed197909e50da5c03c22c025ae593ce
sha256	4430b9f555dfca96555698de32fecd0fd1e099c3f4690c13fb169f4c8972ce9d
sha256	49cd8c05959153106d9a7472cd1042310ad7825eb1260ec155ff906315012634
sha256	4a2f0f1893527e4c419f36c2e4f95a61617074200bb67218fb96ae74125e433b
sha256	4a30256a360aa2dc3c388d39bddb44f0efb0f9e25da2675b03b288b621b0052c
sha256	4c8221b118341c55830cb3b72cff793cd633457d70473a20a1e68c8e5b65222a
sha256	4e339dcdc3e3a8bf5271f7f76a9c4f064d3e34cbb51f8770ff4cce910fbcbce5
sha256	4ebfe8f66ca7e9751060b3301b5e8838d6017593cdae748541de83bfa28183bd
sha256	4f1ade751ddd15affe423ca9f138c7520190137157617d4e89e5fe6dee26c635
sha256	50a891fe72f61b91bca13326f7b334437054fe8e6d6620665c3d47b0118c7792
sha256	53cd02e362b1e50a2dc7becbbba17ab0c196c9a7dd378d6af516570acc046a8e
sha256	5580ad5be7d8ca45533b604d9b4edcfed791d4fb0be8140b0d7fc4cba17c42ac
sha256	5629be21869a83e9b9da86ab16a2d9cebd0aed2c04a9efe2ac044dfe0d5db6b9
sha256	566bb30ad42762b4584c55267158ea901602fc149fb2e0911107e49432de1249
sha256	5753dcccb7f40375067a4a788a78a0846e1ac43d78ba314739594a2145b77fb8
sha256	59221aa9623d86c930357dba7e3f54138c7ccbd0daa9c483d766cd8ce1b6ad26
sha256	5b9040d570452dd8064d539475737c4a2fa6f51b665a9bdfdedace0bb04934a0
sha256	5fbc950e95cd5f466eecaec6e7d388746c714c0464502343d6e3e04c2d6cb917
sha256	616171dbe37f615cde522a11ef4d5f631fbf15f70e10d326f83eca954e5552c6
sha256	664408e2c14cbf4ad1eeea0d7bb65593e612527bacc7b814b00b2f0a445a6cba
sha256	68e5fb92a7d7d182306a025010c77ae2cd89c39031cced13f9686a9f34671041
sha256	69017b82c6d80c3e0dd87898cdd533f104dc2b06c9fcaadfe2943b9c82228924
sha256	69b198e4c33868550e34da5af74162a938166b47c1f25d5a3033aac57a8a42bc
sha256	6aab340b1e06e2d2f3f591183a6669b70c5a6e5934c40f33f804f9b89b2b5452
sha256	6ccbe0765ecb9f4cfffc6cd7176ecb989cd7b4b371e4924563f708d44d935869
sha256	6fbb15997087eeb37320503a99f42d4b41a0fcab92f2b34a833134821642d161
sha256	71ffa9aa7378269d973e975b25c75081fc2172cf2a8f8d7312abe7f801c38f2f
sha256	791b1cafbe292dd99cac33879701b0c76c0bdec8ef67f9c67448c6911b6dbdda
sha256	7c98456c895f4113a53cbff902908e2893b263c0ffa1785dc3d021b3aecf9f5f
sha256	7d4f9aaa72db209626824ad3c8a79b0c3a7300412dd604c1b372abe773000c24
sha256	7fb54d95cb1738deb0d16de8b32547e76dd643e1e4762327a3554e4c4ce9d431
sha256	81e7e8d207b4d758b3fcd164d3b45a9c8bc2bf1e7cb68b1fa7b8198b7fcc76ea
sha256	82e1b88eed1fb8988bcb56488b941e3478cf7bf3d5a9c3a61e115735999f8876
sha256	868938755dbacc4480a5395f12ae9c8467d735cd06bc69b608c84ea5becd40cf
sha256	88a450a634f7393f6053d42df1575afbf82b3e8c7bb7f62dfc9aadcb7b93c94f
sha256	8af226c0aa71fefe5228e881f4b5c5d90a8b41c290b96f44f56990d8dc3fac1c
sha256	8e2c3244d3bf412d5be85525d65226aa24fc430b1908864805d2f2e00be28fda
sha256	9531d9ddd44f9b7834e54994ee0c9332f76f324f17e1f02056afc0a8c5628408
sha256	9a3eeeeac57f58a79659ebf0782fe2abd6b646e8960fcb5e99fb905db5728559
sha256	9b6531cd6e4acf0546fa6df72b74874523e65338ff2605c748c70f0569771a2b
sha256	a25a3e108f62a10caa2b736123ca7350e9dbc1b888c44e909cbd6866205ca671
sha256	a6420bf24c4de18476fafc2ecceeb83d3929344ca8ab5e5d34a9cfbbff016fa6
sha256	a8aa971911908daa82dbac12943d1aa615f05136da28f47fc9e9fa762f03a236
sha256	a8e26db74a9f847a8adbd023b98ea5924cb801c756bb0ab12714a1878eae7d9f
sha256	a9c9af685d1144dbc81bebf40dbb0e5bf66688bf034ac8b0f9d2094b9afee41a
sha256	aaf746d532ae6491e1ff31a1219ef2ebf5fd7de15b7f3ba709d9b5d0577f15b2
sha256	adcd965a58ae039c34220f475fff6a53bd911c58ae9847aee760c04edd96d6e2
sha256	add1cdaad7cba96071b169b555b2225860500c75d506fe7841656d8e4a5242ff
sha256	ae456e90f894c0f039b58550240f71f1b243f5428402178f47d586406ebe9622
sha256	b40fd232b465f00947113abfa284fb7dee0565f2fa5c3be2e347eb0de04c37f9
sha256	b6dc5c1e1ddef7a543288e080b40a8c6acc143fe258c7889ce68d57ab153dee5
sha256	b8afd3a380348bbd5432a6955330377b682a1f35335600501f3985fb3e3719b1
sha256	b9406f9490c3faddc109eca46d2781925a3b9bc9e04488e48013d29fd0e1f1b8
sha256	baeeb416eb46e13927c462dd392bc03f7734a70bcb7a24c873e1b3c42f04304f
sha256	bb68992f6aa2d3f316322e88d9e71491a38e95fd3a27f48084c66b9c210bd17d
sha256	bbcbe7fa01c597f3d37ef3a0c9077b6def10c7986ece115a65852592e9c8fbd3
sha256	bc879518748f2747b4898b4e6938546975692363573f668dcf4661bab62cb635
sha256	c32379e4567a926aa0d35d8123718e2ebeb15544a83a5b1da0269db5829d5ece
sha256	c4614cd001884175ff092c2e2c2c189e78d49e85551e507cdc5cfb16b631f2fc
sha256	c5e549d5d09c15223665a3fff078aaefbc890052c0b819ae6bb768f4300ac692
sha256	c7a8183afc77f89bb00f8b9a57bb3944cb42021a883c67a59b80236398682dcb
sha256	c7ab7cd59325272f114aa5f77c1cd0efe0e7d93a5bd7414c0faff9d7c9f2e38b
sha256	c855eed359270276ccec08902cfd360bbd5ef0dd928ea4626fc69a981fa10a32
sha256	c9444fffb98de28ee1582aac098c2677ecd2b4bb1c6578fbb782c1c338889007
sha256	c97a93c76f55bbb71fa255ed988a9671731dc28ec00103dd2d7b0d02a4dfa8f0
sha256	cdae573ab468b24c28a42d6078daf2da1a4b4c5657a4146ad966e2fe8340cb49
sha256	ce4a84006f9d106e9b32bce24ea9088475e4bf7774affcaeb1421d71a112946f
sha256	d02db967b9ccf083bb79b10216dd5bd150c6dddcad477b95b3fe5dde0ed7e009
sha256	d1aefa4ea3a380c61f74a99b29e02b2ee2ba6d66c1b004fb38faeb647cc87e21
sha256	d371b9bc3af2d0314706a9f395b87661e572d5d4ccbf95a53465374818e5f7e6
sha256	d44b59b50b243fb7413098e9548e5edae2d1bf0439dff8d72e7bbef49d6b522b
sha256	d5cd5301d9458fbc3c41a9fb0371a3857614cb398d1c1090c3bf13a13da3caa9
sha256	d72c1c75958ad7c68ef2fb2480fa9ebe185e457f3b62047b31565857fa06a51a
sha256	d7a5c5145afe6c20fc4d538f379496dad11e841be83ad592fbc32ba2a48e2b4c
sha256	d7b8bfb0c0e04329b9d226d42cbb5b5dec2a8409596a8abf99a139ddae17c8fb
sha256	db88feb7d333429e19f482ab28d95a8bfcb2aa1d9949f549f6da58feb3d033e5
sha256	dd3e3da55a9be4e601f7992b5c4a82f816707e61434a88d04642544f5713c273
sha256	de4362531e4f5e49b816833feb25ae718f758f229b823a8776248df7049fcdd1
sha256	de81eacd045a88598f16680ce01bf99837b1d8170c7fc38a18747ef10e930776
sha256	df3c034de5ecd4c24798bb8f83e20628eccfc6819ed1611ac6f7576bbc0d3bbf
sha256	dffa23dfd1efeec8be847c20e67f7ac37d487e1a31abfed6ffe407bc412dcbed
sha256	e14ffcf75bc0e24a96c1f075d957513396290b22cd68c26a16c75f6dcfc816bf
sha256	e37357e575a8c416e3e7770f2eeece99254833144d3a4ca1cb135fe816da702a
sha256	e3bc168ec734aec9196a0e42cf787888e8842a5ffd4b7271caa0b47a14048771
sha256	e56dfb687fc9f6a16be92701c162a21fde4d8647e583e64f953435e2fc90d67f
sha256	e90163b8ffbe74ef786301ab54e25a07a67d91988efdeec3f6507ddc64e51d0a
sha256	e97e50b6e104fdbcd2dc33cfe3cbb50df9a1fe28326af6d507260b4cb741799f
sha256	eb07431d9f5cd47b5e54bc4759ed5650621bc1086e919686f891fe9ee415de28
sha256	ee3e4dd5c1e073b8805f4107ccc7bc7e6e3c209fe13ea04ff3f2173c8dbe74a6
sha256	f18f150716ee4d2e8ad3cba9fd2d6c49cd99acc62103cbfcedc12a83dc5cf3f6
sha256	f1a64ff07d4805e09e5784b8aad07d82c0419e8db2d7819e0e6e136bd1ca3627
sha256	f57c6001a33ce32d91d22cad1ed406ba1601bc6856e82d7ac0676b10935201e6
sha256	f718df96f7770e29619de136e880bc3dda341ab0fe088de81546ef6396855362
sha256	f805deff11b70100c3ee772394aaa404edfb791a89ef07f690f72a69fd542e5f
sha256	f89ce54fae3ab66ed40da0b0a90a0aeaa5ec70921cf630012f500ad9a4745bc6
sha256	f92792db983f1e82d1dc3a0eaceb28446d88ea1d692c83c0bdde23ef56c1b901
sha256	fd4f7c8c21a658508e1d595e5ecf4536ac3cf851f1f0a624b8b1ff897a103847
sha256	fdba5be3da2467e642bd8710f971e6b266b30ac15f5f413982fd719d7e0bffd9
sha256	fe06f0d6324dca4359f87e4fea76c4068e6bf7265962407f2c67828e128097f6

Research & sources

Read the investigation →

https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace