GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs

GlassWorm campaign distributed a malicious Zig dropper through fake VS Code extensions on Open VSX marketplace, targeting developer environments. The dropper identifies all IDEs on infected systems and deploys a second-stage extension that steals credentials and executes C2 commands via Solana blockchain. Any developer who installed 'specstudio.code-wakatime-activity-tracker' or 'floktokbok.autoimport' should be treated as compromised.