Cybersecurity researchers have flagged another ongoing development glass worm The campaign, which uses a new Zig dropper designed to covertly infect all integrated development environments (IDEs) on a developer’s machine.
This technique has been discovered in an OpenGL VSX extension named “specstudio.code-wakatime-activity-tracker” for WakaTime, a popular tool that measures the time programmers spend inside their IDE. The extension is no longer available for download.
“Expansion […] sends a Zig-compiled native binary along with its JavaScript code,” Aikido security researcher Elias Makari said in an analysis published this week.
“This is not the first time Glassworm has resorted to using native compiled code in an extension. However, instead of using the binary directly as a payload, it is used as a covert signal to the known Glassworm dropper, which can now covertly infect all other IDEs found on your system.”
The newly identified Microsoft Visual Studio Code (VS Code) extension is a replica of Walktime, except for a change introduced in the function called “activate()”. The extension installs a binary called “win.node” on Windows systems and “mac.node,” a universal Mac-O binary if the system is running Apple macOS.
These Node.js native addons are compiled shared libraries written in Zig and loaded directly into Node’s runtime and executed outside the JavaScript sandbox with full operating system-level access.
Once loaded, the primary goal of the binary is to find every IDE on the system that supports VS Code extensions. This includes Microsoft VS Code and VS Code Insiders, as well as several artificial intelligence (AI)-powered coding tools like VSCode, Fork and Cursor, and Windsurf.
The binary then downloads a malicious VS Code extension (.VSIX) from an attacker-controlled GitHub account. The extension – called “floktokbok.autoimport” – impersonates “steoates.autoimport”, a legitimate extension with over 5 million installs on the official Visual Studio Marketplace.
In the final step, the downloaded .VSIX file is written to a temporary path and silently installed in each IDE using each editor’s CLI installer. The second-stage VS Code extension acts as a dropper that avoids execution on Russian systems, talks to the Solana blockchain to bring up a command-and-control (C2) server, exfiltrates sensitive data, and installs a remote access trojan (RAT), which ultimately deploys an information-stealing Google Chrome extension.
Users who have installed “specstudio.code-wakatime-activity-tracker” or “floktokbok.autoimport” are advised to compromise and rotate all secrets.
