GlassWormMalware
According to Koi Security, this malware harvests NPM, GitHub, and Git credentials for supply chain propagation. It targets 49 different cryptocurrency wallet extensions to drain funds. It uses stolen credentials to compromise additional packages and extensions, spreading the worm further.From MISP Galaxy
Last reported 3 days ago, by Dark Reading8 reports
ATT&CK techniques
6 of 19 · each with the sentence it comes from- T1213.003Code Repositories
“GlassWorm operators have targeted software developers since at least early 2025, drawn by their access to source code repositories, cloud platforms, CI/CD pipelines and package registries.”
- T1027Obfuscated Files or Information
“T1027 — Obfuscated Files or Information”
- T1027.018Invisible Unicode
“OpenSourceMalware ties the account to GlassWorm, the malware campaign that hides code in invisible Unicode characters and fetches its next stage from the memo field of a Solana wallet's transactions.”
- T1053.005Scheduled Task
“…cords cmd.exe executing the batch file, followed by PowerShell activity, in-memory payload loading, and persistence through a hidden scheduled task.”
- T1055Process Injection
“…teRemoteThread." The malware can collect system metadata, enable interactive shell access, terminate security processes, implement process injection techniques, replace clipboard text, enumerate local accounts, and terminate itself.”
- T1059Command and Scripting Interpreter
“T1059.007 — Command and Scripting Interpreter: JavaScript”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors“OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors”
-
Info-stealing malware slipped into OVHcloud CLI releases on GitHub“GlassWorm link”
-
Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI“The loader’s next stage queries the Solana blockchain for the location of a further payload, using a wallet that is a known GlassWorm indicator.”
-
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware“The GlassWorm Question”
-
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories“"That build contains the same Solana address, AES key, and execution model previously documented in GlassWorm activity," Socket researcher Kirill Boychenko said.”
-
Introducing Socket Scanning for VS Code Marketplace Extensions“In our recent GlassWorm investigation, Socket’s threat research team uncovered a cluster spanning four VS Code Marketplace extensions and six Open VSX extensions, including two confirmed malicious extensions.”
-
Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX“…four Visual Studio Marketplace and six Open VSX extensions, including two confirmed malicious extensions and a high-confidence link to GlassWorm.”
-
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain“This massive, un-isolated weakness is exactly why registries and marketplaces have become prime targets, as seen in the recent GlassWorm campaign.”
Indicators in its reports
named in the reports above- hxxps://fingercakes4sale[.]store/dsyuCin 2 reports
- fingercakes4sale[.]storein 2 reports
- hunt[.]ioin 1 report
- c2.installscenter[.]comin 1 report
- 173.232.146[.]211in 1 report
- mountaingoats4sale[.]xyzin 1 report
- 45.157.233[.]46in 1 report
- 4c4b9a3773e9dced6015a670855fd32bin 1 report
- data[.]linkin 1 report
- a276b76d3b00f302…c5e51096df07in 1 report
- 5e68ca8c2097cacc…416e87dbf268in 1 report
- 684c877a52d226d5…c79d5b387804in 1 report
- da2d950e50326171…59a45cfb86bbin 1 report
- api.mainnet-beta.solana[.]comin 1 report
- holiday-themes[.]devin 1 report
- painel.installscenter[.]comin 1 report
- 80.78.27[.]252in 1 report
- 45.138.12[.]177in 1 report
- 151.243.232[.]123in 1 report
- hxxps://raw.githubusercontent[.]com/ovh/ovhcloud-cli/main/install.shin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.