Nasty GlassWorm Malware Pivots From Windows To Target Mac Users
GlassWorm spreads by inserting malicious code into legitimate VS Code extensions. The threat actor behind the malware uses special Unicode characters that generate no visual output, meaning that a developer would have a difficult time spotting anything suspicious harbored in their code base.
After making the switch to target macOS, the threat actors behind GlassWorm have shown an impressive skill set. This latest incarnation is handcrafted to take advantage of the macOS environment. It uses AppleScript to stealthily execute code, ensures persistence with the use of LaunchAgents, and opportunistically steals data stored in the Keychain.
So why has this threat actor made this change? The security researchers chalk it up to the kinds of data the attackers want most: cryptocurrency. Macs are commonly used by developers in various industries, including web3 and crypto startups, making macOS fertile ground worth going after.
What makes it particularly potent this time around is that Glasswork is now capable of attacking hardware wallets. GlassWorm is able to replace the applications used to manage these wallets with a trojanized version of its own, bypassing the security protections offered by hardware wallets. For now, this functionality is merely present and hasn’t been activated, but it’s just a matter of time until it’s completely enabled.
Malware such as this one is insidious because it leverages legitimate extensions to deliver payloads, making it difficult for users to avoid. The best advice is to limit how many extensions you download to minimize the risk of a shady extension infecting your systems.
