Loading threat actor…
GlassWorm is a Russian-speaking cybercriminal supply-chain threat actor targeting software developers, open-source projects, developer workstations, and IDE extension ecosystems. Also tracked as GlassWorm Operator, the actor has operated since at least 2025 and distributes trojanized packages and extensions through npm, PyPI, GitHub, OpenVSX, and Visual Studio Code-related marketplaces. Operations include malicious and sleeper extensions, compromised maintainer accounts, hijacked repositories, malicious dependency-installation scripts, and concealed JavaScript payloads embedded with Unicode variation selectors. GlassWorm has used stolen developer credentials to compromise and poison hundreds of GitHub repositories, including by force-pushing malicious changes into default branches. GlassWorm malware enumerates compatible IDEs and can silently propagate malicious extensions across developer environments. Its staged tooling steals developer credentials, cloud and CI/CD secrets, browser data, cryptocurrency-wallet data, SSH material, API tokens, and other sensitive data. It deploys persistent remote-access tooling, SOCKS proxies, hidden VNC capability, arbitrary command execution, and malicious browser extensions capable of keylogging, clipboard and screenshot capture, and web-session-cookie theft. The actor has also used hardware-wallet recovery phishing to obtain cryptocurrency seed phrases. GlassWorm employs resilient multilayer command-and-control infrastructure using Solana transaction memo fields, BitTorrent DHT, Google Calendar event metadata, and conventional server infrastructure. It uses geofencing to avoid Russian and other CIS-region systems, execution rate limiting, runtime decryption and obfuscation, and deletion of deployment artifacts. The actor is assessed as Russian-speaking based on Russian-language code comments and consistent CIS-avoidance logic.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
45 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
39 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Campagne de compromission de la chaîne d’approvisionnement visant les développeurs. Le groupe diffuse une extension OpenVSX usurpant WakaTime, exécute un addon natif Zig, puis propage une extension VSIX malveillante à tous les IDE compatibles VS Code détectés. Le second étage géofence/exclut les systèmes russes, communique via un C2 fondé sur Solana, exfiltre des données, installe un RAT persistant et déploie une extension Chrome pour keylogging et vol de cookies de session.
Malware/worm using Solana transaction memo fields as a dead drop resolver by querying recent wallet transactions and decoding payloads from memo instructions.
Associated with a supply-chain campaign involving trojanized Open VSX extensions delivering GlassWASM, using WebAssembly for obfuscation and the Solana blockchain as a dead-drop C2 mechanism.
Used trojanized extensions and compromised packages to poison GitHub repositories at scale using stolen credentials.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.