{"id":235998,"date":"2026-04-27T22:23:29","date_gmt":"2026-04-28T03:23:29","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/04\/glassworm-malware-attacks-return-via-73-openvsx-sleeper-extensions"},"modified":"2026-04-27T22:23:29","modified_gmt":"2026-04-28T03:23:29","slug":"glassworm-malware-attacks-return-via-73-openvsx-sleeper-extensions","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/04\/glassworm-malware-attacks-return-via-73-openvsx-sleeper-extensions","title":{"rendered":"GlassWorm malware attacks return via 73 OpenVSX \u201csleeper\u201d extensions"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/glassworm-malware-attacks-return-via-73-openvsx-sleeper-extensions.jpg\"><\/a><\/p>\n<p>A new wave of the Glassworm campaign is targeting the OpenVSX ecosystem with 73 \u201csleeper\u201d extensions that turn malicious after an update.<\/p>\n<p>Six of the extensions have been activated and deliver malware, while researchers assess with high confidence that the rest of them are dormant or at least suspicious.<\/p>\n<p>When initially uploaded, the extensions are benign but deliver the payload at a later stage, revealing the attacker\u2019s true intention.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A new wave of the Glassworm campaign is targeting the OpenVSX ecosystem with 73 \u201csleeper\u201d extensions that turn malicious after an update. Six of the extensions have been activated and deliver malware, while researchers assess with high confidence that the rest of them are dormant or at least suspicious. When initially uploaded, the extensions are [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[],"class_list":["post-235998","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/235998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=235998"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/235998\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=235998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=235998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=235998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}