GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS)
GlassWorm Developer Supply Chain Campaign Takedown (TL-2026-0603), also tracked as GlassWorm, is a high-severity supply-chain compromise, first published 2026-05-27. It is attributed to GlassWorm Operators (Russia) with medium confidence, affects Eclipse Foundation Open VSX Registry, maps to 31 MITRE ATT&CK techniques (T1027, T1027.013, T1041), and is covered by 9 detection rules and 49 indicators of compromise.
Key facts for TL-2026-0603
- Threat ID
- TL-2026-0603
- Also known as
- GlassWorm, OpenVSX Worm, Invisible Code Worm
- Severity
- HIGH
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-05-27
- Last reviewed
- 2026-05-27
- Attribution
- GlassWorm Operators
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, government, financial, cryptocurrency, open-source-maintainers
- Target regions
- Global, North America, Europe, Middle East, Asia
- Detection rules
- 9
- Indicators of compromise
- 49
Malware and tooling in GlassWorm Developer Supply Chain Campaign Takedown
Malware and tooling: GlassWorm, GlassWormRAT, ZOMBI, GlassWormRAT, RedExt, ZOMBI
On 2026-05-27 CrowdStrike, Google, and the Shadowserver Foundation announced the simultaneous neutralization of all four C2 channels used by GlassWorm, the first self-propagating worm targeting the VS Code / OpenVSX extension ecosystem. Active since at least October 2025, GlassWorm trojanized extensions across OpenVSX, the Microsoft VS Code Marketplace, Cursor, Windsurf, Positron, and VSCodium, plus npm and Python packages, and weaponized stolen developer credentials to poison 300+ GitHub repositories. Its payload, GlassWormRAT, is a WebSocket-based JavaScript RAT that pivots into the ZOMBI module — turning developer hosts into SOCKS / Hidden VNC / WebRTC proxy infrastructure — and deploys a Chrome extension for screenshot, keystroke, and clipboard capture.
How GlassWorm Developer Supply Chain Campaign Takedown works
GlassWorm is a self-propagating supply chain worm first publicly disclosed by Koi Security on 2025-10-18 after the actor compromised 7 OpenVSX extensions on 2025-10-17 (later expanded to 13 OpenVSX + 1 VS Code Marketplace extension `cline-ai-main.cline-ai-agent` v3.1.3 on 2025-10-19; ~35,800 cumulative installations) and resurfaced on 2025-11-06 with three more OpenVSX extensions (`ai-driven-dev.ai-driven-dev`, `adhamu.history-in-sublime-merge`, `yasuyuky.transient-emacs`; ~10,000 installations).
**Invisible-code stealth.** The worm hides its bootstrap in invisible Unicode variation selectors injected into otherwise benign-looking JavaScript inside the extension's `extension.js`. To a human reviewer or static scanner the malicious line renders as whitespace; the V8 / Node interpreter, however, executes it verbatim. This is the first observed weaponization of Unicode variation selectors as a packer for marketplace extensions.
**Four-channel resilient C2.** GlassWorm operators built a deliberately redundant C2 stack so that no single takedown could disable the botnet:
1. **Solana blockchain (primary discovery channel)** — Wallet `28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2` issues SPL transactions whose `memo` instruction field contains the current C2 URL. The malware queries a public Solana RPC endpoint, walks the wallet's transaction list, and decodes the most recent memo to obtain a fresh staging URL. Three known config-update transactions (`49CDiVWZpu…`, `3eVTqgEVdU…`, `3v3jCvKfdv…`) were observed between 2025-10-15 and 2025-11-06. 2. **Google Calendar dead drop** — Public calendar `https://calendar.app.google/M2ZCvM8ULL56PD1d6` owned by `uhjdclolkdn@gmail.com`. Event titles encode fallback C2 URLs. Removed during the takedown after coordination with Google's Threat Analysis Group. 3. **BitTorrent DHT** — The ZOMBI module joins the public Mainline DHT and uses peer announce / get_peers traffic against attacker-controlled info-hashes as a covert configuration channel. Disrupted by Shadowserver via DHT sinkholing. 4. **Commercial VPS** — Direct hardcoded fallback servers `217.69.3.218` and `199.247.10.166` (BL Networks / Vultr ranges) serving the second-stage archive at `/get_arhive_npm/` and `/get_zombi_payload/<base64>`. Exfiltration sinks on `140.82.52.31:80/wall` and `199.247.13.106:80/wall`.
**GlassWormRAT (Stage 2).** A WebSocket-based JavaScript RAT loaded from `http://217.69.3.218/get_arhive_npm/` after the bootstrap decodes the Solana memo. It establishes a wss:// session for live tasking and exposes commands for credential harvesting (NPM `~/.npmrc`, GitHub PATs from `gh` config and OS keyring, OpenVSX publisher tokens, Git credential helper, environment variables), crypto-wallet theft against 49 known browser extensions (MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Solflare, Backpack, Keplr, Rabby, OKX, Brave Wallet, etc.), and lateral repo compromise — using the stolen GitHub credentials to push AI-generated, plausibly-worded malicious commits into 300+ repos starting 2025-10-31.
**ZOMBI module (Stage 3).** Final payload that converts the workstation into multi-protocol proxy infrastructure. ZOMBI fuses four sub-components: (a) a SOCKS5 server bound to a high port and tunneled out-bound to the C2; (b) Hidden VNC giving operators a full desktop session indistinguishable from the user's; (c) WebRTC peer routing for NAT traversal and P2P remote-execution; (d) BitTorrent DHT participation for resilient discovery. The resulting botnet was sold/used as a residential-proxy and malware-distribution backbone.
**Chrome extension implant.** GlassWormRAT side-loads an unpacked Chromium extension into developer profiles (Chrome, Brave, Edge, Arc) granting it `tabs`, `scripting`, `storage`, and `<all_urls>` host permissions. It exfiltrates full-page screenshots on tab change, keystrokes via injected content-scripts, and clipboard contents on every focus event — yielding 2FA codes, password-manager autofill, and recovery seeds.
**Persistence.** Run keys `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\Software\Microsoft\Windows\CurrentVersion\Run` re-launch the bootstrap; on macOS a LaunchAgent plist is dropped in `~/Library/LaunchAgents`. The Chrome extension itself acts as a soft persistence layer because it survives RAT removal.
**Attribution.** Multiple independent indicators point to a Russian-speaking actor: (a) Cyrillic comments in deobfuscated bootstrap, (b) malware self-terminates if `GetUserDefaultLangID()` / `Intl.DateTimeFormat().resolvedOptions().locale` falls inside the CIS bloc (RU, BY, KZ, UZ, AZ, AM, KG, TJ, MD, TM), (c) RedExt-family panel artefacts observed on the staging VPS, (d) victimology that excludes Russian-language repositories. Attribution confidence: MEDIUM (no formal nation-state nexus established; consistent with financially-motivated Russian-speaking crimeware crew with side ESPIONAGE tasking against a Middle Eastern government victim disclosed in November 2025).
**Takedown (2026-05-27).** CrowdStrike Counter Adversary Operations led the operation: Solana wallet activity was monitored and a poisoned config transaction was broadcast to redirect remaining beacons to sinkholes; Google TAG terminated `uhjdclolkdn@gmail.com` and the public calendar; Shadowserver sinkholed the BitTorrent DHT info-hashes and the two VPS subnets; OpenVSX and the VS Code Marketplace pulled all known malicious versions and rotated publisher tokens. Despite the disruption defenders should treat all developer credentials touched by an affected workstation as compromised — the worm's self-propagation guarantees dormant secondary infections in private repos and CI pipelines.
MITRE ATT&CK techniques used in TL-2026-0603
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1497.001 Virtualization/Sandbox Evasion: System Checks
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Credential Access
T1056.001 Input Capture: Keylogging; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1090.002 Proxy: External Proxy; T1102.001 Web Service: Dead Drop Resolver; T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer; T1573.002 Encrypted Channel: Asymmetric Cryptography
Collection
T1113 Screen Capture; T1115 Clipboard Data
Persistence
T1176 Software Extensions; T1543.001 Create or Modify System Process: Launch Agent; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Initial Access
T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain
Discovery
T1217 Browser Information Discovery; T1518 Software Discovery
Impact
Lateral Movement
T1550.001 Use Alternate Authentication Material: Application Access Token
discovery
T1614.001 System Location Discovery: System Language Discovery
Affected products and versions in GlassWorm Developer Supply Chain Campaign Takedown
- Eclipse Foundation — Open VSX Registry
Vulnerable versions: all (publisher-token theft based)
Fixed in: malicious extension versions removed 2025-10-18 onward; tokens rotated 2026-05-27 - Microsoft — Visual Studio Code Marketplace
Vulnerable versions: cline-ai-main.cline-ai-agent 3.1.3
Fixed in: malicious version removed 2025-10-19 - Microsoft — Visual Studio Code
Vulnerable versions: all consuming affected extensions
Fixed in: uninstall affected extensions - Anysphere — Cursor
Vulnerable versions: all consuming affected OpenVSX extensions
Fixed in: uninstall affected extensions - Codeium — Windsurf
Vulnerable versions: all consuming affected OpenVSX extensions
Fixed in: uninstall affected extensions - Posit — Positron
Vulnerable versions: all consuming affected OpenVSX extensions
Fixed in: uninstall affected extensions - VSCodium Project — VSCodium
Vulnerable versions: all consuming affected OpenVSX extensions
Fixed in: uninstall affected extensions - OpenJS Foundation — npm registry packages
Vulnerable versions: unspecified packages compromised via stolen publisher tokens
Fixed in: affected packages identified by npm security; rotate all developer tokens - Python Software Foundation — PyPI packages
Vulnerable versions: unspecified packages compromised via stolen publisher tokens
Fixed in: audit PyPI publishes by affected maintainers; rotate API tokens - GitHub — Repositories (300+)
Vulnerable versions: repos owned by affected developer accounts 2025-10-31 through 2026-05-27
Fixed in: force-rotate tokens; audit commits from affected developers
Remediation for GlassWorm Developer Supply Chain Campaign Takedown
Immediate actions
- Audit installed VS Code / Cursor / Windsurf / Positron / VSCodium extensions against the published GlassWorm extension+version list and uninstall any match
- Block egress to 217.69.3.218, 199.247.10.166, 140.82.52.31, 199.247.13.106 at perimeter and EDR firewall
- Block resolution of calendar.app.google/M2ZCvM8ULL56PD1d6 and alert on any process touching the path
- Revoke and rotate all GitHub PATs, npm publish tokens, OpenVSX publisher tokens, and SSH keys present on any developer workstation that installed an affected extension
- Force-rotate every secret committed to any GitHub repo touched by an affected developer between 2025-10-15 and 2026-05-27
- Treat all browser-stored credentials and crypto-wallet seeds on affected hosts as compromised — restore wallets from offline seed and transfer funds
- Remove the unauthorized Chromium extension by deleting unmanaged extensions in chrome://extensions and clearing Default/Extensions in the user profile
Workarounds
- Temporarily disable the OpenVSX gallery in VS Code forks and revert to first-party Microsoft Marketplace with Verified Publisher filter until ecosystem-wide invisible-Unicode scanning is in place
- Run developer workstations under a non-admin user with AppLocker / Gatekeeper blocking writes to Run keys and LaunchAgents
Longer-term hardening
- Enforce signed extensions only and pin allow-listed publishers via VS Code policy (`extensions.autoUpdate=false`, `extensions.allowed`)
- Deploy EDR rules for child processes of Code.exe / cursor.exe spawning powershell/curl/wget or making WebSocket connections to non-corporate hosts
- Require hardware-backed (FIDO2/Passkey) authentication for GitHub, npm, and OpenVSX publish operations
- Move npm/PyPI/OpenVSX traffic through an internal proxy/mirror that performs invisible-Unicode scanning and dependency provenance checks (Sigstore, npm provenance)
- Introduce a Chrome / Edge enterprise policy that blocks unpacked / developer-mode extension loads on developer endpoints
- Implement Solana memo-field monitoring for known malicious wallet families in network detection stack
Weaknesses (CWE) in GlassWorm Developer Supply Chain Campaign Takedown
CWE-506, CWE-1395, CWE-829, CWE-94
Timeline of GlassWorm Developer Supply Chain Campaign Takedown
- First GlassWorm config-update Solana transaction broadcast from wallet 28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2 pointing to staging VPS 217.69.3.218.
- Seven OpenVSX extensions trojanized with invisible-Unicode bootstrap; ~35,800 total downloads across the affected versions.
- Koi Security publishes the first GlassWorm disclosure — the first observed self-propagating worm in the VS Code / OpenVSX ecosystem and first weaponization of Unicode variation selectors as marketplace payload packer.
- Microsoft VS Code Marketplace extension cline-ai-main.cline-ai-agent v3.1.3 confirmed infected; six additional OpenVSX extensions identified, bringing the public IOC list to 13 OpenVSX + 1 Marketplace extension.
- Stolen GitHub tokens used to push AI-generated malicious commits into 300+ third-party repositories, bootstrapping a parallel propagation channel independent of the marketplaces.
- GlassWorm resurfaces on OpenVSX with three new infected extensions (ai-driven-dev.ai-driven-dev, adhamu.history-in-sublime-merge, yasuyuky.transient-emacs) — ~10,000 additional downloads. Same exfil VPS, Solana wallet updated to new C2 URL.
- Keylogger telemetry recovered from a sinkholed beacon identifies a major Middle Eastern government entity among GlassWorm victims; victimology suggests opportunistic capture rather than targeted operation.
- CrowdStrike Counter Adversary Operations, Google Threat Analysis Group, and Shadowserver Foundation begin coordinated tracking of the GlassWorm botnet for joint disruption.
- Coordinated takedown announced: Solana wallet beacons redirected to sinkhole, Google Calendar dead drop terminated, BitTorrent DHT info-hashes sinkholed by Shadowserver, VPS C2 servers (217.69.3.218 / 199.247.10.166) and exfil sinks (140.82.52.31 / 199.247.13.106) null-routed; marketplaces purge remaining malicious versions and rotate publisher tokens.
- As of 2026-05-29, the May 26-27 CrowdStrike/Google/Shadowserver takedown disrupted all four GlassWorm C2 channels but neutralized infrastructure only — no arrests, the Russian-based operators remain at large and capable of reconstituting. Stolen developer credentials, 300+ poisoned repos, and dormant sleeper infections stay a live concern, keeping it MONITORING not RESOLVED.
Sources cited for GlassWorm Developer Supply Chain Campaign Takedown
- GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure
- First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace
- Live Updates: GlassWorm, First Self-Propagating Worm Using Invisible Code Hits OpenVSX And VSCode Marketplaces
- Self-Propagating GlassWorm Attacks VS Code Supply Chain
- GlassWorm — Self-Propagating VSCode Extension Worm
- GlassWorm: The First Self-Propagating VS Code Extension Worm
- Supply Chain Attack Targets VS Code Extensions With GlassWorm Malware
- Defending Against GlassWorm: The Invisible Malware That's Rewriting Supply Chain Security
- GlassWorm Malware Has Resurfaced on the Open VSX Registry
- Self-Propagating Worm Found in Marketplaces for Visual Studio Code Extensions
- Detecting GlassWorm with YARA Rules
Threats related to GlassWorm Developer Supply Chain Campaign Takedown
- GlassWorm Supply Chain Campaign: 73 Malicious Open VSX Extensions Using Transitive Dependencies
- GlassWorm v2 — 73 Open VSX Sleeper Extensions Activate Supply Chain Malware Against VS Code, Cursor, Windsurf and VSCodium Developers
- GlassWorm v3 Supply Chain Attack — 72 Malicious Open VSX Extensions, 151 GitHub Repos & ZOMBI Botnet Module
- GlassWorm Supply Chain Attack via Trojanized VS Code Extensions on Open VSX
- Suspected Russian Actor Uses AI Slopsquatting to Publish 1,000+ Malicious npm Packages (WEL1DROPPER / "Flooding Dropper")
- TrapDoor Crypto Stealer Supply Chain Campaign — 34 Malicious Packages Across npm, PyPI, and Crates.io with Zero-Width Unicode AI Assistant Injection
Detection coverage for TL-2026-0603
As of 2026-05-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0603 across Splunk SPL, Microsoft KQL and Sigma, covering 49 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.