Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
Malware Families
Excerpt
Socket uncovered a theme cluster spanning four Visual Studio Marketplace and six Open VSX extensions, including two confirmed malicious extensions and a high-confidence link to GlassWorm. The Socket Threat Research team identified two suspicious VS Code themes still available on the Visual Studio Marketplace at the time of writing: Coca-Cola Christmas and Aurora Borealis Studio Theme . Both present themselves as polished color themes, contain executable JavaScript despite…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://fingercakes4sale.store/dsyuC | High | Score 63/100 | First seen |
| MD5 | 4c4b9a3773e9dced6015a670855fd32b | Medium | Score 53/100 | First seen |
| Domain | holiday-themes.dev | High | Score 58/100 | First seen |
| SHA256 | 5e68ca8c2097caccdb74d2752b85b85595a4bf646b442b8431a2416e87dbf268 | Medium | Score 43/100 | First seen |
| SHA256 | a276b76d3b00f302bb4dfb3690125c85ff472b16049c3c37476ac5e51096df07 | Medium | Score 49/100 | First seen |
| support@holiday-themes.dev | High | Score 58/100 | First seen | |
| SHA256 | 684c877a52d226d50584cb886ca8ec5bec6355d4de853f406734c79d5b387804 | Medium | Score 53/100 | First seen |
| SHA256 | da2d950e50326171adbff9c2bfd6f28998e32623ea7c2c475b9159a45cfb86bb | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…