A new wave of cyber threats is actively targeting both developers and everyday users. The “GlassWorm” malware campaign has shifted its tactics to infect macOS systems via malicious extensions for coding platforms like VSCode, aiming to steal passwords, cryptocurrency keys, and even hijack wallets. Attempts to replace legitimate wallet software are currently unsuccessful. Despite warnings, over 33,000 downloads of these harmful extensions highlight their widespread reach. Simultaneously, cybersecurity experts have uncovered a low-cost, highly obfuscated Python-based malware called VVS Stealer, which is designed to stealthily extract sensitive data such as Discord credentials, browser info, and cookies. This malware can hijack active sessions and is often used by cybercriminals to spread further attacks, turning compromised systems into tools for larger malicious activities. Both threats emphasize the importance of vigilance. Developers and users are urged to delete suspicious software, update passwords, and monitor their systems for signs of infection to safeguard their data and digital assets. CTIX analysts will continue to report on the latest malware strains and attack methodologies.