🦄‍🪽 Unicode Characters & GlassWorm 🥛🐛

Invisible Unicode Characters and the GlassWorm Malware In October of last year, researchers at Koi Security discovered malware targeting Visual Studio Code and Open VSX extensions. By the time it was detected, it had already spread to around 35,000 machines. It was only discovered after an extension “introduced some suspicious behavioral changes”, which prompted deeper investigation by the researchers Instead of inserting visible malicious code, it used Unicode characters to inject hidden instructions directly into the source. These characters occupy space in a file but have no visual representation, so the malicious code is effectively invisible to the human eye. You could review the source normally and never see the payload. Once installed, it got right to work. The extension would: - Harvest credentials from npm, GitHub, and Git configs - Look for and target cryptocurrency extensions to drain funds - Deploy proxy servers to help create botnets - Install hidden VNC servers for remote