GlassWorm Supply Chain Attack: Fake Browser Extension & Multi-Stage RAT via Compromised Developer Packages — Threadlinqs Intelligence
As of 2026-05-30, GlassWorm Supply Chain Attack: Fake Browser Extension & Multi-Stage RAT via Compromised Developer Packages is a high-severity supply chain threat attributed to GlassWorm Operator (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0287 · Severity: HIGH · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: GlassWorm Operator · N/A · FINANCIAL
GlassWorm is an active multi-stage supply chain attack targeting developers through 433+ compromised npm, PyPI, GitHub, and VS Code/OpenVSX packages. The infection chain delivers an infostealer, a
GlassWorm is a persistent, evolving supply chain campaign that establishes initial access through rogue packages published across multiple developer ecosystems: npm, PyPI, GitHub repositories, VS Code Marketplace, and OpenVSX. The campaign has compromised over 433 components as of March 2026, including 200 GitHub Python repositories, 151 JavaScript/TypeScript repositories, 72 VS Code/OpenVSX extensions, and 10+ npm packages.
The attack employs a novel obfuscation technique using Unicode Private Use Area (PUA) characters in the ranges U+FE00-U+FE0F (Variation Selectors) and U+E0100-U+E01EF (Variation Selectors Supplement) to hide malicious payloads. These characters render as zero-width whitespace in code editors, making visual detection impossible. A hidden decoder extracts bytes from these characters and passes them to JavaScript's eval() function for execution.
The multi-stage infection chain begins with compromised packages executing preinstall hooks or invisible Unicode loaders. The malware first fingerprints the victim machine and implements geofencing by checking the OS locale against Russian patterns (ru_RU, ru-RU) and timezone against Russian timezone ranges (Europe/Moscow through Asia/Anadyr), skipping execution if a Russian locale is detected.
C2 infrastructure leverages the Solana blockchain as a dead-drop resolver. The attacker owns private keys for Solana addresses and uses Solana's Memo program to post JSON instructions containing C2 server URLs. Victim malware queries these addresses via Solana RPC endpoints, reads the latest memo, and decodes the base64 link field to obtain the active C2 URL. The primary C2 discovery uses DHT (Distributed Hash Table) lookup for a pinned public key, with Solana serving as fallback.
Stage 2 deploys a comprehensive data-theft framework targeting browser credentials (login data, cookies, autofill, payment cards), cryptocurrency wallet credentials, npm tokens (validated in real-time against the npm registry), GitHub tokens, SSH keys, VS Code secrets, cloud credentials, and environment variables. Stolen data is compressed to ZIP and exfiltrated.
Stage 3 delivers two additional components: (a) a .NET binary (Assaac.exe) that monitors for USB hardware wallet insertion via WMI and presents phishing interfaces for Ledger/Trezor seed phrase capture, and (b) a Node.js RAT with a Chrome extension installer. The RAT maintains persistence through scheduled tasks at highest privileges, registry Run keys, and process signal hooks (SIGINT, SIGTERM, SIGQUIT, SIGHUP, SIGUSR2) for auto-restart on termination.
The force-installed Chrome extension masquerades as 'Google Docs Offline' (v1.95.1) and is installed without user consent via native modules. It registers with a C2 server resolved from a separate Solana wallet memo, polls for commands at 5-30 second intervals, and supports extensive surveillance capabilities: cookie and localStorage theft, full DOM tree capture, screenshot capture, keystroke logging with form metadata, clipboard monitoring, browser history extraction (up to 5,000 entries), bookmark export, and installed extension enumeration. The extension includes pre-configured targeting for Bybit cryptocurrency exchange with webhook alerting on authentication detection.
The campaign has evolved to include 'ForceMemo' — a variant that uses stolen GitHub tokens to inject malicious code into legitimate Python repositories via force-push, preserving original commit metadata to evade detection. This affects Django apps, ML research code, Streamlit dashboards, and PyPI packages. Two compromised React Native npm packages alone had 130,000+ monthly downloads.
GlassWorm also targets the MCP (Model Context Protocol) ecosystem, publishing npm packages impersonating the WaterCrawl MCP server, marking the campaign's expansion into AI developer tooling supply chains.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-116
Target sectors: technology, software-development, cryptocurrency, financial, open-source
Target regions: Global, North America, Europe, Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1593, T1584, T1585, T1587, T1608, T1195, T1195, T1059, T1059, T1204