Ankura CTIX FLASH Update – January 6, 2026

Malware Activity

Malware Threats Targeting Developers and Users

A new wave of cyber threats is actively targeting both developers and everyday users. The "GlassWorm" malware campaign has shifted its tactics to infect macOS systems via malicious extensions for coding platforms like VSCode, aiming to steal passwords, cryptocurrency keys, and even hijack wallets. Attempts to replace legitimate wallet software are currently unsuccessful. Despite warnings, over 33,000 downloads of these harmful extensions highlight their widespread reach. Simultaneously, cybersecurity experts have uncovered a low-cost, highly obfuscated Python-based malware called VVS Stealer, which is designed to stealthily extract sensitive data such as Discord credentials, browser info, and cookies. This malware can hijack active sessions and is often used by cybercriminals to spread further attacks, turning compromised systems into tools for larger malicious activities. Both threats emphasize the