GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs

GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs Ravie LakshmananApr 10, 2026Malware / Blockchain Cybersecurity researchers have flagged yet another evolution of the ongoing GlassWorm campaign, which employs a new Zig dropper that's designed to stealthily infect all integrated development environments (IDEs) on a developer's machine. The technique has been discovered in an Open VSX extension named "specstudio.code-wakatime-activity-tracker," which masquerades as WakaTime, a popular tool that measures the time programmers spend inside their IDE. The extension is no longer available for download. "The extension [...] ships a Zig-compiled native binary alongside its JavaScript code," Aikido Security researcher Ilyas Makari said in an analysis published this week. "This is not the first time GlassWorm has resorted to using native compiled code in extensions. However, rather than using the binary as the payload directly, it is used as a stealthy indirection for the known GlassWorm dropper, which now secretly infects all other IDEs it can find on your system." The newly identified Microsoft Visual Studio Code (VS Code) extension is a near replica of WakaTime, save for a change introduced in a function named "activate()." The extension installs a binary named "win.node" on Windows systems and "mac.node," a universal Mach-O binary if the system is running Apple macOS. These Node.js native addons are compiled shared libraries that are written in Zig and load directly into Node's runtime and execute outside the JavaScript sandbox with full operating system-level access. Once loaded, the primary goal of the binary is to find every IDE on the system that supports VS Code extensions. This includes Microsoft VS Code and VS Code Insiders, as well as forks like VSCodium, Positron, and a number of artificial intelligence (AI)-powered coding tools like Cursor and Windsurf. The binary then downloads a malicious VS Code extension (.VSIX) from an attacker-controlled GitHub account. The extension – called "floktokbok.autoimport" – impersonates "steoates.autoimport," a legitimate extension with more than 5 million installs on the official Visual Studio Marketplace. In the final step, the downloaded .VSIX file is written to a temporary path and silently installed into every IDE using each editor's CLI installer. The second-stage VS Code extension acts as a dropper that avoids execution on Russian systems, talks to the Solana blockchain to fetch the command-and-control (C2) server, exfiltrates sensitive data, and installs a remote access trojan (RAT), which ultimately deploys an information-stealing Google Chrome extension. Users who have installed "specstudio.code-wakatime-activity-tracker" or "floktokbok.autoimport" are advised to assume compromise and rotate all secrets. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Blockchain, cybersecurity, Information Stealer, Malware, Open VSX, Remote Access Trojan, Software Supply Chain, Visual Studio Code Trending News Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems New SparkCat Variant in iOS, Android Apps Steals Crypto Wallet Recovery Phrase Images China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware BKA Identifies REvil Leaders Behind 130 German Ransomware Attacks Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass Block the Prompt, Not the Work: The End of "Doctor No" AI Will Change Cybersecurity. Humans Will Define Its Success. A Lesson No Algorithm Can Teach Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials Apple Expands iOS 18.7.7 Update to More Devices to Block DarkSword Exploit New GPUBreach Attack Enables Full CPU Privilege Escalation via GDDR6 Bit-Flips ⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch Released Microsoft Details Cookie-Controlled PHP Web Shells Persisting via Cron on Linux Servers The AI Arms Race – Why Unified Exposure Management Is Becoming a Boardroom Priority Load More ▼ Popular Resources Get Full Visibility into Vendor and Internal Risk in One Platform [Guide] Get Practical Steps to Govern AI Agents with Runtime Controls Secure Your AI Systems Across the Full Lifecycle of Risks Learn How to Block Breached Passwords in Active Directory Before Attacks