GlassWorm Uses Malicious Developer Packages to Install a Surveillance Extension
Summary
The article describes GlassWorm infections through malicious or compromised developer packages, followed by credential theft, a Node.js RAT, and a force-installed Chrome extension that monitors browser activity. It also gives mitigation advice.
Key points
- The article says GlassWorm spreads through malicious packages or compromised accounts associated with npm, GitHub, PyPI, and VS Code.
- A preinstall script or loader fingerprints the system, skips Russian locales, and uses Solana transaction memos to locate a later payload.
- The reported infostealer targets browser and wallet data, developer credentials, VS Code secrets, and cloud credentials.
- A later stage delivers a Ledger/Trezor phishing binary and a Node.js RAT, which persists through scheduled tasks and Run registry keys.
- The RAT can force-install a fake Chrome extension that collects cookies, page contents, bookmarks, screenshots, keystrokes, clipboard data, and browser history.
- The article recommends pinning trusted package versions, reviewing maintainer changes and browser extensions, checking startup mechanisms, and using updated anti-malware.
Article Details
- Event Type
- GlassWorm malware campaign distributed through malicious or compromised developer packages, deploying an infostealer, a Ledger/Trezor phishing binary, a Node.js RAT, and a fake Chrome extension.
- Impact
- The reported infection chain steals browser data, wallet seeds and keys, developer credentials, and cloud credentials; sends stolen data to a remote server; and uses persistence and a force-installed extension to enable remote access and surveillance. The article says stolen credentials and access tokens could support wider supply-chain attacks. Its current setup appears focused on developers who may hold cryptocurrency assets.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 217[.]69[.]0[.]159 | Listed as an IP used for stage-two payload delivery and RAT/WebSocket C2. |
| IPV4 | 217[.]69[.]3[.]152 | Listed as an IP used for stage-two payload delivery and RAT/WebSocket C2. |
| IPV4 | 45[.]150[.]34[.]158 | Listed as an IP used for stage-two payload delivery and RAT/WebSocket C2. |
| IPV4 | 45[.]32[.]150[.]251 | Reportedly used for stage-two payload delivery and as a WebSocket RAT C2 address; Malwarebytes says it blocks this IP. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe infostealer sends collected information to a remote server in POST requests.T1053.005 · Scheduled TaskThe RAT establishes persistence by creating scheduled tasks.T1056 · Input CaptureThe force-installed Chrome extension captures keystrokes and clipboard content.T1059.007 · JavaScriptA package preinstall script or invisible Unicode loader runs code on the victim machine; the article identifies the RAT as Node.js.T1082 · System Information DiscoveryThe loader fingerprints the machine and checks its locale, stopping execution for Russian locales.T1102 · Web ServiceThe attacker reportedly uses a Solana transaction memo field to retrieve payload locations or configuration.T1105 · Ingress Tool TransferThe infection chain retrieves stage-two and stage-three payloads after initial execution.T1195 · Supply Chain CompromiseThe campaign is described as using malicious packages and compromised maintainer accounts in developer ecosystems for initial access.T1547.001 · Registry Run Keys / Startup FolderThe RAT establishes persistence using Run registry keys.T1555.003 · Credentials from Web BrowsersThe infostealer targets browser extension profiles and browser-stored credentials and cookies.
Malware
Products
GitHubGlassWorm is distributed via developer channels—malicious new packages or compromised maintainer accounts on npm, GitHub, PyPI, and VS Code extensions.Google Chromea Ledger/Trezor phishing binary, and a Node.js RAT that gains persistence, forceâinstalls a fake Chrome extension to monitor activity, and enables broader supplyâchain and credentialâbased attacks.LedgerAfter initial execution it deploys an infostealer, a Ledger/Trezor phishing binary, and a Node.js RAT that gains persistence, forceâinstalls a fake Chrome extension to monitor activity, and enables broadernpmGlassWorm infiltrates developer ecosystems by distributing malicious or compromised npm/PyPI/VS Code packages that run hidden preinstall scripts to fingerprint systems and retrieve secondary payload locations from thePyPIGlassWorm infiltrates developer ecosystems by distributing malicious or compromised npm/PyPI/VS Code packages that run hidden preinstall scripts to fingerprint systems and retrieve secondary payload locations from theSolanarun hidden preinstall scripts to fingerprint systems and retrieve secondary payload locations from the Solana blockchain.TrezorAfter initial execution it deploys an infostealer, a Ledger/Trezor phishing binary, and a Node.js RAT that gains persistence, forceâinstalls a fake Chrome extension to monitor activity, and enables broaderVS CodeGlassWorm infiltrates developer ecosystems by distributing malicious or compromised npm/PyPI/VS Code packages that run hidden preinstall scripts to fingerprint systems and retrieve secondary payload locations from the