Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX

MITRE Techniques

• [T1195.002 ] Supply Chain Compromise – Threat actors abused theme extensions and publisher ecosystems to deliver malicious code through software distribution channels (‘compromise software supply chain’).
• [T1027 ] Obfuscated Files or Information – Aurora Nocturne Night Theme used heavily obfuscated JavaScript, runtime string reconstruction, zero-width Unicode encoding, and compressed single-line code (‘heavily obfuscated, roughly 59 KB JavaScript blob’).
• [T1140 ] Deobfuscate/Decode Files or Information – The extension decoded zero-width Unicode payloads and decrypted embedded stages before execution (‘decoded=zeroWidthDecode(encoded); eval(decoded);’, ‘decrypts embedded JavaScript stage with AES-256-CBC’).
• [T1105 ] Ingress Tool Transfer – Aurora Nocturne Night Theme downloaded a threat actor-controlled payload from fingercakes4sale[.]store and wrote it to a local batch file (‘Download threat actor-controlled content’).
• [T1102.001 ] Web Service: Dead Drop Resolver – Cosmic Nebula Themes queried a Solana transaction memo to dynamically resolve follow-on payload infrastructure (‘Use Solana transaction memos as a dead-drop to dynamically resolve follow-on payload infrastructure’).
• [T1059.007 ] Command and Scripting Interpreter: JavaScript – The malicious extensions executed recovered JavaScript using eval() and Node.js VM execution (‘executes it through eval()’, ‘execute decoded threat actor-controlled JavaScript’).
• [T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – Aurora Nocturne Night Theme executed the downloaded batch script through cmd.exe (‘executes it through cmd.exe’, ‘cmd /c’).
• [T1614.001 ] System Location Discovery: System Language Discovery – Cosmic Nebula Themes checked for Russian-language systems and bypassed them (‘Exit on systems matching Russian locale/timezone conditions’).