cyber.hendryadrian.com
Security News · thehackernews.com

GlassWorm’s ForceMemo Offshoot Uses Stolen GitHub Tokens to Inject Malware Into Python Repositories

· Original article ↗

Summary

Researchers say GlassWorm’s ForceMemo offshoot uses tokens stolen through malicious VS Code and Cursor extensions to force-push obfuscated payloads into Python repositories, retrieving further payload URLs from a Solana transaction memo.

Key points

  • StepSecurity says ForceMemo uses GitHub tokens stolen by GlassWorm malware delivered through malicious VS Code and Cursor extensions.
  • The stolen tokens are reportedly used to force-push obfuscated code into Python files such as setup.py, main.py, and app.py across compromised repositories.
  • The injected code checks for a Russian system locale and, otherwise, reads a payload URL from a Solana transaction memo.
  • The payload reportedly downloads encrypted JavaScript and other files, including code designed to steal cryptocurrency and data.
  • StepSecurity says the earliest observed repository injections date to March 8, 2026; the force-push method preserves commit metadata and can hide changes from GitHub’s visible history.
  • Aikido separately linked a campaign affecting more than 151 GitHub repositories to the same Solana wallet, while Socket reported another GlassWorm distribution method using extension dependencies.

Article Details

Event Type
Software supply-chain attack using stolen GitHub tokens to force-push malware into Python repositories.
Impact
The article reports malicious code injected into hundreds of Python repositories. Users who install from a compromised repository or clone and execute its code may trigger additional payloads, including encrypted JavaScript designed to steal cryptocurrency and data; the article does not confirm successful theft.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe injected payloads were obfuscated and Base64-encoded; the article also describes encrypted JavaScript payloads.T1105 · Ingress Tool TransferThe injected code reportedly retrieved a payload URL from a Solana transaction memo and downloaded additional payloads.T1195.001 · Compromise Software Dependencies and Development ToolsThe attackers reportedly used malicious VS Code and Cursor extensions to compromise developer systems and steal GitHub tokens.T1195.002 · Compromise Software Supply ChainThe attackers reportedly injected malware into Python repositories, exposing users who install or execute code from compromised repositories.T1528 · Steal Application Access TokenThe attackers reportedly stole GitHub access tokens from compromised developer systems and used them to modify repositories.T1565.001 · Stored Data ManipulationThe attackers reportedly rebased and force-pushed malicious changes to repository files, rewriting Git history.

Threat Actors

GlasswormThe article attributes the ForceMemo activity to the GlassWorm threat actor, while citing security firms linking the activity to the broader GlassWorm campaign.

Malware

GlassWormThe GlassWorm campaign’s ForceMemo offshoot uses stolen GitHub tokens — harvested via malicious VS Code and Cursor extensions — to force-push obfuscated, Base64-encoded payloads into hundreds of Python repositories by

Products

CursorGlassWorm campaign’s ForceMemo offshoot uses stolen GitHub tokens — harvested via malicious VS Code and Cursor extensions — to force-push obfuscated, Base64-encoded payloads into hundreds of Python repositories byGitHubThe GlassWorm campaign’s ForceMemo offshoot uses stolen GitHub tokens — harvested via malicious VS Code and Cursor extensions — to force-push obfuscated, Base64-encoded payloads into hundreds of Python repositories byVS CodeThe GlassWorm campaign’s ForceMemo offshoot uses stolen GitHub tokens — harvested via malicious VS Code and Cursor extensions — to force-push obfuscated, Base64-encoded payloads into hundreds of Python repositories by

Related Articles