The Glassworm malware campaign has resurfaced with unprecedented scale, deploying 24 malicious extensions across Microsoft Visual Studio Marketplace and OpenVSX over the past week.

This latest wave of attacks demonstrates the persistent threat posed by supply chain compromises targeting developer tools.

The malware specifically clones legitimate extensions for popular frameworks, including Flutter, Tailwind, Vim, Yaml, Svelte, React Native, and Vue, making it difficult for developers to distinguish between authentic and fraudulent packages.

The attack mechanism exploits the trust developers place in extension marketplaces by initially publishing seemingly legitimate packages that pass security reviews.

Once approved, the extensions receive updates containing hidden malicious code, allowing the attackers to bypass existing security filters.

Secure Annex security researchers identified that these malicious extensions employ sophisticated techniques to manipulate download counts and artificially inflate installation statistics, positioning the fake extensions directly alongside legitimate ones within the IDE interface.

This social engineering tactic makes it challenging for users to identify the correct extension during installation.

Infection Mechanism and Evolution

The infection process begins when developers install what appears to be a legitimate extension from the marketplace.

The malicious payload activates immediately after the extension loads into the development environment. Once activated, the code executes embedded implants that were previously hidden within the extension package.

The attackers have evolved their evasion tactics significantly, transitioning from invisible Unicode characters in earlier iterations to Rust-based implants embedded directly inside the extensions.

When the extension activates, it runs the malicious code within the developer’s system context, giving attackers access to sensitive information such as environment variables, authentication tokens, and project source code.

The sophisticated obfuscation techniques make detection difficult without specialized security analysis tools. Secure Annex analysts noted the consistent attack signatures and patterns across the campaigns, linking various techniques together despite their evolution.

The researchers discovered that many extensions continue staging operations while manipulating download statistics to build credibility before final deployment.

The identified compromised packages span both marketplaces, with notable examples including prisma-inc.prisma-studio-assistance, prettier-vsc.vsce-prettier, and flutter-extension across both platforms.

Organizations using these extensions face significant risk from unauthorized system access and data exfiltration.

Security professionals recommend immediately auditing installed extensions and implementing marketplace scanning solutions to detect and prevent future compromises.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Glassworm Malware Hits OpenVSX and Microsoft Visual Studio Platforms with 24 New Packages appeared first on Cyber Security News.

A new malware campaign has emerged that exploits the trust users place in popular applications.

Threat actors are distributing trojanized installers for Telegram, WinSCP, Google Chrome, and Microsoft Teams to deploy ValleyRat, a remote access trojan designed for long-term system compromise.

The campaign has been attributed to the China-aligned APT group known as Silver Fox, which has remained active since at least 2022.

The infection begins when victims download what appears to be a legitimate application installer through spear-phishing emails or malicious advertisements.

On the surface, users see a normal installation interface, but hidden processes run silently in the background.

The malware stages files, deploys kernel-level drivers, tampers with endpoint security, and ultimately launches a ValleyRat beacon that maintains persistent access to the compromised system.

Nextron Systems security researchers identified this campaign through their detailed analysis of the entire infection chain.

Their investigation revealed that the attackers combine multiple layers of obfuscation, endpoint security tampering, and kernel-level techniques to evade detection while establishing command-and-control communications with remote servers.

The distribution primarily occurs through trojanized Telegram installers. One analyzed sample, named tg.exe, carries the SHA-256 hash 9ede6da5986d8c0df3367c395b0b3924ffb12206939f33b01610c1ae955630d1.

Despite displaying a genuine Telegram Desktop 6.0.2 interface, closer inspection reveals notable inconsistencies.

The PE header timestamp dates to 2019, while its first VirusTotal submission occurred in August 2025, representing an unusual six-year gap for a frequently updated application.

Infection Mechanism and Defense Evasion

Once executed, the installer creates the directory C:\ProgramData\WindowsData\ and drops essential files, including a renamed 7-Zip binary (funzip.exe) and an encrypted archive disguised as main.xml.

The malware then uses PowerShell to add a Microsoft Defender exclusion for the entire C:\ drive, effectively silencing antivirus protection.

The archive extraction command reveals the embedded password:-

"C:\ProgramData\WindowsData\funzip.exe" x -y -phtLcENyRFYwXsHFnUnqK -o"C:\ProgramData\WindowsData" "C:\ProgramData\WindowsData\main.xml"

This extraction deploys men.exe, the main orchestrator that performs environmental reconnaissance by scanning for security processes, including Microsoft Defender’s MsMpEng.exe and Chinese security products like ZhuDongFangYu.exe and 360tray.exe.

The campaign establishes persistence through a scheduled task named WindowsPowerShell.WbemScripting.SWbemLocator, designed to mimic legitimate Windows components, which executes an encoded VBScript launching the ValleyRat beacon for continued system access.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Leverages Telegram, WinSCP, Google Chrome, and Microsoft Teams to Deploy ValleyRat appeared first on Cyber Security News.