Loading malware…
GlassWorm is a credential-stealing worm targeting software developers through compromised repositories, software packages, and malicious or hijacked Visual Studio Code extensions distributed through Visual Studio Marketplace and Open VSX. First documented in October 2025, it uses stolen GitHub, Git, npm, and Open VSX credentials to compromise additional projects and extensions, enabling further propagation. Campaigns have impersonated popular developer tools, frameworks, and editor themes, including introducing malicious updates into previously benign extensions.
GlassWorm conceals executable JavaScript using invisible Unicode characters and encrypted payloads. Its staged loaders query public Solana RPC services and extract next-stage locations from transaction memos, allowing operators to change payload infrastructure without updating installed malware. Some variants use Google Calendar as a backup infrastructure resolver. Observed implementations include JavaScript loaders and Rust-based native implants for Windows and macOS; repository-based loaders also support execution on Linux. Execution delays, Russian-language and timezone exclusions, and in-memory execution help evade analysis and detection.
The malware steals browser credentials, cookies and session information, developer tokens, cryptocurrency wallet secrets, and macOS Keychain data. It exfiltrates collected information and can establish SOCKS proxies and remote-access channels on compromised systems. macOS variants use AppleScript and LaunchAgents for persistence, while earlier Windows activity uses PowerShell and Registry-based mechanisms. GlassWorm has also attempted to replace Ledger Live and Trezor Suite with attacker-supplied applications. Its targeting of developer workstations provides access to source repositories, package-publishing accounts, and downstream software distribution channels.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
OpenSourceMalware ties the attack to the GlassWorm threat actors. In May 2026, CrowdStrike, Google and the Shadowserver Foundation disrupted the GlassWorm botnet by taking down its four command-and-control channels simultaneously.
These investigations have identified a central figure known online as "ResoluteXBF" with connections to South African-based infrastructure. Even though the group was relatively new when it emerged in 2010, it has rapidly evolved from the Shai-Hulud campaign to subsequent operations that involved malware such as GlassWorm...
83 distinct techniques documented for this family, organized by ATT&CK tactic.
In some instances, such as the daeumer-web.es-linter-for-vs-code package, attackers used direct typosquatting of legitimate publisher names to appear trustworthy and trick unsuspecting victims.
More than 300 GitHub repositories were poisoned using stolen developer credentials harvested from earlier Glassworm infections
Within a short period of time, the threat actor compromised more than 1,000 software packages and weaponized trusted development channels... Through compromise of CI runners, TeamPCP effectively converted trusted software distribution channels into malware delivery channels... downstream developers were able to retrieve them using package managers, GitHub Actions, Python libraries, NPM registries, and other software components that were configured to pull the latest releases from the repository.
« ciblant spécifiquement les développeurs via le Visual Studio Marketplace et le registre Open VSX »
Socket uncovered a theme cluster spanning four Visual Studio Marketplace and six Open VSX extensions, including two confirmed malicious extensions and a high-confidence link to GlassWorm.
More than 300 GitHub repositories were poisoned using stolen developer credentials harvested from earlier Glassworm infections, with malicious code force-pushed into default branches.
This is the core social engineering pattern behind the latest GlassWorm cluster: cloned listings create enough visual trust to attract installs before any malware is introduced.
It gains persistence by setting up scheduled tasks and Run registry keys so that the RAT comes back on every reboot.
It then force-pushed malicious commits to every repository the victim’s account could reach, spreading the infection to any developer who later cloned those repositories.
« le sauvegardait sous %TEMP%\temp_batch.cmd, puis l’exécutait via cmd.exe en masquant la fenêtre »
« Cosmic Nebula Themes : décryptait du JavaScript embarqué via AES-256-CBC et l’exécutait immédiatement via eval() »
which loads a native binary operating entirely outside the restrictive JavaScript sandbox with unfettered system access
The next month, researchers discovered the Glassworm attack, which utilizes VS Code extensions to compromise developer machines.
In its latest iteration, threat actors used a malicious OpenVSX extension impersonating WakaTime, bundling a Zig-compiled binary.
GlassWorm stealer, which was distributed via malicious IDE extensions on the Open VSX Registry.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.
GlassWorm is not limited to extensions that carry malicious code directly. It started to abuse these two VS Code-style manifest relationships ( extensionPack and extensionDependencies ) to turn one extension into an indirect installer for another.
The attack targets Python projects ... by appending obfuscated code to files like setup.py, main.py, and app.py. Anyone who runs pip install from a compromised repo or clones and executes the code will trigger the malware.
It gains persistence by setting up scheduled tasks and Run registry keys so that the RAT comes back on every reboot.
More than 300 GitHub repositories were poisoned using stolen developer credentials harvested from earlier Glassworm infections
establishes persistent remote access through a rogue Chrome extension
Bundlore can persist via a LaunchAgent. Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence. CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.
The malicious code steals data and installs a persistent RAT, including a malicious Chrome extension.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or batch files in the Windows Startup folder.
It gains persistence by setting up scheduled tasks and Run registry keys so that the RAT comes back on every reboot.
More than 300 GitHub repositories were poisoned using stolen developer credentials harvested from earlier Glassworm infections
Bundlore can persist via a LaunchAgent. Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence. CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.
The malicious code steals data and installs a persistent RAT, including a malicious Chrome extension.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or batch files in the Windows Startup folder.
« utilisait des noms aléatoires, des échappements hexadécimaux et des caractères Unicode invisibles pour masquer sa charge utile »
The campaign we analyzed, however, uses a different and under-observed class of characters (variation selectors) that remain largely invisible to common tooling.
Remote decryption: Decryption keys are no longer stored within the extension itself; they are now retrieved dynamically from attacker-controlled HTTP response headers like ivbase64 and secretkey.
The injection preserves the original commit author and date, making it look like nothing in the project history has changed.
« L’extension était publiée sous l’identité microsoft pour se faire passer pour une extension officielle. »
Afterward, it deletes traces of the installer.
More than 300 GitHub repositories were poisoned using stolen developer credentials harvested from earlier Glassworm infections
The next month, researchers discovered the Glassworm attack, which utilizes VS Code extensions to compromise developer machines.
« Après décodage, il contactait fingercakes4sale[.]store » ; « décryptait du JavaScript embarqué via AES-256-CBC »
Before doing anything visible, the malware validates the environment. It checks locale settings and will exit early on systems configured with Russian-language locales... It also probes for EDR software: CrowdStrike Falcon, SentinelOne, Carbon Black, and the StepSecurity Harden-Runner for GitHub Actions are all specifically detected.
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.
GlassWorm is not limited to extensions that carry malicious code directly. It started to abuse these two VS Code-style manifest relationships ( extensionPack and extensionDependencies ) to turn one extension into an indirect installer for another.
The attack targets Python projects ... by appending obfuscated code to files like setup.py, main.py, and app.py. Anyone who runs pip install from a compromised repo or clones and executes the code will trigger the malware.
Execution guardrails: The malware continues to utilize staged JavaScript execution, in-memory follow-on code execution...
it can also be used to take screenshots and act as a keylogger.
Once active, GlassWorm harvested GitHub tokens, npm tokens, OpenVSX tokens, and cryptocurrency wallet data.
Server 208.85.20[.]124 -- documented in the original GlassWorm reporting as a credential theft endpoint -- is still live... browse stolen credentials... Browser credential dumper
"Harvests NPM, GitHub, and Git credentials"; "NPM authentication tokens... GitHub tokens... OpenVSX credentials"
Glassworm ... is a self-propagating, credential-stealing worm ... later poisoned more than 300 GitHub repos using stolen credentials harvested in earlier Glassworm infections.
Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge
A small decoder passes them to eval() , and suddenly you are running a full malicious payload that steals tokens, credentials, and secrets.
Glassworm steals GitHub tokens from multiple sources, including VS Code storage, the git credentials file, and local environment variables.
The malware checks the victim's locale, language settings, and timezone at runtime
Before doing anything visible, the malware validates the environment. It checks locale settings and will exit early on systems configured with Russian-language locales... It also probes for EDR software: CrowdStrike Falcon, SentinelOne, Carbon Black, and the StepSecurity Harden-Runner for GitHub Actions are all specifically detected.
"The malware avoids execution on systems using Russian-language settings."
Static decryption recovered a second-stage loader that performs Russian-language and timezone gating.
It then force-pushed malicious commits to every repository the victim’s account could reach, spreading the infection to any developer who later cloned those repositories.
The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.
it can also be used to take screenshots and act as a keylogger.
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
Besides stealing cookies, localStorage, the full Document Object Model (DOM) tree of the active tab, bookmarks, screenshots... it can also be used to take screenshots
Besides stealing cookies, localStorage, the full Document Object Model (DOM) tree of the active tab, bookmarks, screenshots, keystrokes, clipboard content...
The RAT also force-installs a Chrome extension ... which acts as an onboard session surveillance. Besides stealing cookies, localStorage, the full Document Object Model (DOM) tree of the active tab...
"...collects credentials, keychains, and documents, compresses them into an archive, and exfiltrates the data..."
CrowdStrike, together with Google and the Shadowserver Foundation, neutralized all four GlassWorm command-and-control channels on May 26, 2026.
The third deploys a persistent backdoor using WebSockets.
Glassworm used invisible Unicode-based code injection, blockchain-based C2 infrastructure, and Google Calendar as a backup command server to turn infected developers’ machines into criminal proxy nodes.
The Solana dead-drop mechanism: infected machines query a Solana wallet's transaction history to discover the current C2 address.
« La blockchain Solana est utilisée comme mécanisme de C2 dynamique, permettant de changer l’infrastructure sans publier de nouvelle version d’extension. »
Its loader uses Solana transaction memos as a dead-drop to dynamically resolve follow-on infrastructure, allowing the threat actor to change the next-stage delivery location without republishing the extension.
"The malware uses the Solana blockchain as its command and control infrastructure"; "reads the memo field... JSON object with a base64-encoded link" | "The malware reaches out to this Google Calendar event as a backup C2 mechanism... base64-encoded URL"
« il contactait fingercakes4sale[.]store, téléchargeait du contenu contrôlé par l’attaquant et le sauvegardait sous %TEMP%\temp_batch.cmd »
In April, Aikido researchers reported a new attack by the GlassWorm stealer... Ultimately, this second-stage implant exfiltrated crypto wallet data, environment variables, and other secrets. It also installed a RAT on the infected device.
The ABI-decoded response holds the C2 pointer. Operators pick the encoding: a plain UTF-8 URL, Base64, Base64 plus XOR, gzip plus Base64, or a bash one-liner.
AES-encrypted Stage-2 payloads have their keys delivered via HTTP response headers.
"access private repositories, pull data"; "data exfil" is referenced generally in the article context of downstream harm
[STAGE 2: ENCRYPTED PAYLOAD] AES-CBC decrypt using header-delivered keys -> credential stealer / RAT
After gathering this information, it sends it to a remote server via a POST request.
90 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
120 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.