GlassWorm attackers activate new ‘sleeper’ extensions on Open VSX
Overview
Researchers have identified a new group of 73 malicious extensions linked to the GlassWorm campaign, which are designed to mimic legitimate projects. These extensions have been activated on Open VSX, a marketplace for Visual Studio Code extensions. The attackers aim to deceive users into installing these fake extensions, potentially compromising their systems. This incident raises concerns for developers and organizations using Open VSX, as it exposes them to security risks if they inadvertently install these malicious add-ons. Users need to be cautious and verify the authenticity of extensions before installation to avoid falling victim to this ongoing attack.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Open VSX marketplace, Visual Studio Code extensions
- Action Required: Users should verify the authenticity of extensions before installation and consider removing any suspicious or unknown extensions.
- Timeline: Newly disclosed
Original Article Summary
A new cluster of 73 extensions impersonating legitimate projects has been tied to the GlassWorm campaign.
Impact
Open VSX marketplace, Visual Studio Code extensions
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Newly disclosed
Remediation
Users should verify the authenticity of extensions before installation and consider removing any suspicious or unknown extensions.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.