GlassWorm Uses Solana Dead Drops to Deliver RAT and Steal Browser, Crypto Data
Summary
Researchers describe GlassWorm’s multi-stage campaign, which uses malicious packages and compromised maintainer accounts to deploy data-theft tools, hardware-wallet phishing, a RAT, and a malicious Chrome extension.
Key points
- GlassWorm spreads through rogue packages on npm, PyPI, GitHub, and Open VSX, and poisoned updates pushed through compromised maintainer accounts.
- The stage-two framework harvests credentials, cryptocurrency wallets, and system data, then compresses collected information into ZIP archives for exfiltration.
- A .NET component detects Ledger or Trezor devices and displays persistent phishing windows to capture 24-word wallet recovery phrases.
- The JavaScript RAT retrieves C2 details through a DHT or Solana-based dead drops and supports remote desktop access, proxying, browser-data theft, and JavaScript execution.
- A force-installed Google Docs Offline Chrome extension can collect cookies, keystrokes, screenshots, browser history, and other browser data; the article says it targets Bybit sessions.
- Researchers report that GlassWorm impersonated a WaterCrawl MCP server in npm packages, marking its first confirmed move into the MCP ecosystem.
- Developers are advised to verify package publishers and histories; AFINE published glassworm-hunter, a local scanning tool that researchers say makes no network requests during scans.
Article Details
- Attack Vectors
- Rogue packages across npm, PyPI, GitHub, and Open VSX, plus poisoned updates pushed through compromised maintainer accounts, provide initial access.
- The stage-two framework harvests credentials, cryptocurrency wallet data, and system information, compresses collected data into a ZIP archive, and sends it to an external server.
- A .NET component detects Ledger or Trezor USB connections and displays fake wallet recovery prompts to capture 24-word recovery phrases.
- A JavaScript RAT retrieves C2 details through DHT or Solana-based dead drops and supports remote JavaScript execution, browser-data theft, HVNC access, and SOCKS proxying.
- The RAT force-installs a malicious Chrome extension posing as Google Docs Offline to collect browser data and monitor targeted sessions.
- The operators published npm packages impersonating the WaterCrawl MCP server to distribute malicious payloads.
- Defensive Notes
- Exercise caution when installing Open VSX extensions, npm packages, and MCP servers; verify publisher names and package histories, and do not rely blindly on download counts.
- AFINE's open-source glassworm-hunter scans local files for campaign-associated payloads without making network requests during scanning; its update command fetches an IOC database from GitHub.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 45[.]150[.]34[.]158 | IP address to which the malware transmits captured hardware-wallet recovery phrases. |
| IPV4 | 45[.]32[.]150[.]251 | C2 address used by the campaign and to fetch the RAT payload. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe campaign sends harvested data, including wallet recovery phrases and browser data, to external or C2 infrastructure.T1056.001 · KeyloggingThe RAT and extension capture keystrokes.T1059.007 · JavaScriptThe RAT executes attacker-supplied JavaScript through eval().T1082 · System Information DiscoveryThe RAT sends system information, and the stage-two framework profiles the system.T1090 · ProxyThe RAT can launch a WebRTC module and run it as a SOCKS proxy.T1102.001 · Dead Drop ResolverThe malware uses Solana transactions as dead-drop resolvers to retrieve C2 details.T1113 · Screen CaptureThe RAT and extension capture screenshots from compromised systems or browser sessions.T1176 · Software ExtensionsThe RAT force-installs a malicious Chrome extension posing as Google Docs Offline.T1195.001 · Compromise Software Dependencies and Development ToolsThe campaign distributes rogue packages through npm, PyPI, GitHub, and Open VSX and pushes poisoned updates through compromised maintainer accounts.T1539 · Steal Web Session CookieThe extension collects browser cookies and session-token material, including targeted Bybit cookies.T1555.003 · Credentials from Web BrowsersThe framework and extension steal browser credentials, cookies, and session tokens.
People
Ilyas MakariAikido security researcher cited for reporting technical details of the GlassWorm campaign and its malicious extension.Lotan SeryKoi security researcher cited on GlassWorm's use of npm packages impersonating an MCP server.Paweł WoykeAFINE researcher quoted about the behavior of the glassworm-hunter scanning tool.Sławomir ZakrzewskiAFINE researcher quoted about the behavior of the glassworm-hunter scanning tool.
Products
Bravereget_log, to steal data from web browsers, such as Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Mozilla Firefox.Google Chromedata theft and installing a remote access trojan (RAT), which deploys an information-stealing Google Chrome extension masquerading as an offline version of Google Docs.Google Docs OfflineThe chain includes a .NET hardware-wallet phishing binary, a WebSocket JavaScript RAT that force-installs a malicious “Google Docs Offline” Chrome extension, and dead-drop C2 resolvers on the Solana blockchain.LedgerA .NET component detects Ledger and Trezor USB connections and displays persistent phishing windows to capture 24-word recovery phrases.Ledger LiveThe malware not only kills any real Ledger Live processes running on the Windows host, but also re-displays the phishing window if the victim closes it.Microsoft Edgereget_log, to steal data from web browsers, such as Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Mozilla Firefox.Mozilla Firefoxreget_log, to steal data from web browsers, such as Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Mozilla Firefox.Operareget_log, to steal data from web browsers, such as Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Mozilla Firefox.Opera GXreget_log, to steal data from web browsers, such as Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Mozilla Firefox.TrezorA .NET component detects Ledger and Trezor USB connections and displays persistent phishing windows to capture 24-word recovery phrases.Vivaldireget_log, to steal data from web browsers, such as Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Mozilla Firefox.