# GlassWorm Supply Chain Attack: Fake Browser Extension & Multi-Stage RAT via Compromised Developer Packages

> GlassWorm is an active multi-stage supply chain attack targeting developers through 433+ compromised npm, PyPI, GitHub, and VS Code/OpenVSX packages. The infection chain delivers an infostealer, a Node.js RAT with Solana blockchain-based C2 dead-drop resolution, and a force-installed fake Chrome extension ('Google Docs Offline') for persistent browser surveillance including keylogging, DOM capture, credential theft, and cryptocurrency wallet exfiltration.

- **Published:** 2026-03-26T12:00:00Z
- **Last reviewed:** 2026-03-26T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0287
- **ID:** TL-2026-0287
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** GlassWorm Operator
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GlassWorm is a persistent, evolving supply chain campaign that establishes initial access through rogue packages published across multiple developer ecosystems: npm, PyPI, GitHub repositories, VS Code Marketplace, and OpenVSX. The campaign has compromised over 433 components as of March 2026, including 200 GitHub Python repositories, 151 JavaScript/TypeScript repositories, 72 VS Code/OpenVSX extensions, and 10+ npm packages.
The attack employs a novel obfuscation technique using Unicode Private Use Area (PUA) characters in the ranges U+FE00-U+FE0F (Variation Selectors) and U+E0100-U+E01EF (Variation Selectors Supplement) to hide malicious payloads. These characters render as zero-width whitespace in code editors, making visual detection impossible. A hidden decoder extracts bytes from these characters and passes them to JavaScript's eval() function for execution.
The multi-stage infection chain begins with compromised packages executing preinstall hooks or invisible Unicode loaders. The malware first fingerprints the victim machine and implements geofencing by checking the OS locale against Russian patterns (ru_RU, ru-RU) and timezone against Russian timezone ranges (Europe/Moscow through Asia/Anadyr), skipping execution if a Russian locale is detected.
C2 infrastructure leverages the Solana blockchain as a dead-drop resolver. The attacker owns private keys for Solana addresses and uses Solana's Memo program to post JSON instructions containing C2 server URLs. Victim malware queries these addresses via Solana RPC endpoints, reads the latest memo, and decodes the base64 link field to obtain the active C2 URL. The primary C2 discovery uses DHT (Distributed Hash Table) lookup for a pinned public key, with Solana serving as fallback.
Stage 2 deploys a comprehensive data-theft framework targeting browser credentials (login data, cookies, autofill, payment cards), cryptocurrency wallet credentials, npm tokens (validated in real-time against the npm registry), GitHub tokens, SSH keys, VS Code secrets, cloud credentials, and environment variables. Stolen data is compressed to ZIP and exfiltrated.
Stage 3 delivers two additional components: (a) a .NET binary (Assaac.exe) that monitors for USB hardware wallet insertion via WMI and presents phishing interfaces for Ledger/Trezor seed phrase capture, and (b) a Node.js RAT with a Chrome extension installer. The RAT maintains persistence through scheduled tasks at highest privileges, registry Run keys, and process signal hooks (SIGINT, SIGTERM, SIGQUIT, SIGHUP, SIGUSR2) for auto-restart on termination.
The force-installed Chrome extension masquerades as 'Google Docs Offline' (v1.95.1) and is installed without user consent via native modules. It registers with a C2 server resolved from a separate Solana wallet memo, polls for commands at 5-30 second intervals, and supports extensive surveillance capabilities: cookie and localStorage theft, full DOM tree capture, screenshot capture, keystroke logging with form metadata, clipboard monitoring, browser history extraction (up to 5,000 entries), bookmark export, and installed extension enumeration. The extension includes pre-configured targeting for Bybit cryptocurrency exchange with webhook alerting on authentication detection.
The campaign has evolved to include 'ForceMemo' — a variant that uses stolen GitHub tokens to inject malicious code into legitimate Python repositories via force-push, preserving original commit metadata to evade detection. This affects Django apps, ML research code, Streamlit dashboards, and PyPI packages. Two compromised React Native npm packages alone had 130,000+ monthly downloads.
GlassWorm also targets the MCP (Model Context Protocol) ecosystem, publishing npm packages impersonating the WaterCrawl MCP server, marking the campaign's expansion into AI developer tooling supply chains.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1584 Compromise Infrastructure
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1176 Software Extensions
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1480 Execution Guardrails
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1056 Input Capture
- T1082 System Information Discovery
- T1518 Software Discovery
- T1185 Browser Session Hijacking
- T1115 Clipboard Data
- T1113 Screen Capture
- T1005 Data from Local System
- T1102 Web Service
- T1071 Application Layer Protocol
- T1008 Fallback Channels
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking

## Sources

- [Malwarebytes: GlassWorm attack installs fake browser extension for surveillance](https://www.malwarebytes.com/blog/news/2026/03/glassworm-attack-installs-fake-browser-extension-for-surveillance)
- [The Hacker News: GlassWorm Malware Uses Solana Dead Drops to Deliver RAT and Steal Browser, Crypto Data](https://thehackernews.com/2026/03/glassworm-malware-uses-solana-dead.html)
- [The Hacker News: GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos](https://thehackernews.com/2026/03/glassworm-attack-uses-stolen-github.html)
- [The Hacker News: GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers](https://thehackernews.com/2026/03/glassworm-supply-chain-attack-abuses-72.html)
- [Aikido Security: GlassWorm RAT Delivered via Malicious Chrome Extension (Keylogger, Cookie Theft)](https://www.aikido.dev/blog/glassworm-chrome-extension-rat)
- [Aikido Security: Glassworm Returns - Invisible Unicode Malware Found in 150+ GitHub Repositories](https://www.aikido.dev/blog/glassworm-returns-unicode-attack-github-npm-vscode)
- [Bleeping Computer: GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX](https://www.bleepingcomputer.com/news/security/glassworm-malware-hits-400-plus-code-repos-on-github-npm-vscode-openvsx/)
- [SecurityWeek: ForceMemo - Python Repositories Compromised in GlassWorm Aftermath](https://www.securityweek.com/forcememo-python-repositories-compromised-in-glassworm-aftermath/)
- [Security Boulevard: An Evolving GlassWorm Malware is Making the Rounds of Code Repositories](https://securityboulevard.com/2026/03/an-evolving-glassworm-malware-is-making-the-rounds-of-code-repositories/)
- [StepSecurity: ForceMemo - Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push](https://www.stepsecurity.io/blog/forcememo-hundreds-of-github-python-repos-compromised-via-account-takeover-and-force-push)
- [AFINE glassworm-hunter: Open-source detection tool](https://github.com/AfineLabs/glassworm-hunter)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0287