GlassWorm's Evolution: Zig Droppers Targeting All IDEs via Open VSX
Just caught the latest report on the GlassWorm campaign, and it looks like they've pivoted to a pretty concerning supply chain tactic. Researchers found a new Zig-based dropper hiding inside a malicious Open VSX extension named specstudio.code-wakatime-activity-tracker.
For those who missed it, this extension is masquerading as the legitimate WakaTime tracker. Once installed, the Zig dropper doesn't just sit there—it actively scans the machine to compromise other IDEs, not just VS Code. The use of Zig is notable here because it allows for cross-platform compilation and static binaries, helping them evade some traditional EDR heuristics that rely on specific OS dependencies.
I’ve whipped up a quick hunting query to check your endpoints for this specific malicious extension ID. Run this in PowerShell on your Windows dev workstations:
$MaliciousID = "specstudio.code-wakatime-activity-tracker"
$ExtPath = "$env:USERPROFILE\.vscode\extensions"
if (Test-Path $ExtPath) {
Get-ChildItem -Path $ExtPath -Directory |
Where-Object { $_.Name -like "*$MaliciousID*" } |
Select-Object FullName, LastWriteTime
}
If you find it, investigate the `~/.wakatime` directory for unexpected binaries immediately.
Given the prevalence of developer-targeted malware lately (like the recent npm packages), how is everyone handling extension whitelisting? Are you blocking Open VSX entirely, or relying on strict signature policies?
We’re seeing similar activity in our SOC telemetry. The Zig dropper is particularly annoying because it spawns a zig.exe process that compiles payloads on the fly in the %TEMP% directory, which often bypasses application whitelisting that allows compilers.
We added a KQL rule to look for zig.exe parent processes spawning from Code.exe or idea64.exe. It’s noisy for shops that actually use Zig, but for a JS/Python shop, it’s a goldmine for detection.
This is exactly why we force our devs to use an internal proxy for marketplace requests. We maintain a local mirror of Open VSX and npm, and nothing gets published without a manual code review by the security team.
It slows down deployment for new tools, but it’s better than explaining to the CISO why our source code got exfiltrated because someone wanted a time-tracking widget.
Good catch on the Zig angle. I've been playing around with Zig for red team tools recently—its cross-platform capabilities are insane for this kind of stuff. The static linking means you don't need to drop a bunch of DLLs or so files, which keeps the footprint small.
From a defensive perspective, if you aren't monitoring for unsigned compilers running in user directories, you're going to miss this.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access