GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure

GlassWorm targets developers through malicious VS Code extensions and packages to harvest credentials and establish persistent access.

• •Trojanized extensions from Microsoft Marketplace, Open VSX, malicious npm and Python packages
• •Steals GitHub tokens, crypto wallets, browser data via JavaScript RAT
• •Four C2 channels: Solana blockchain, BitTorrent DHT, Google Calendar, direct VPS
• •Poisoned 300+ GitHub repositories using stolen credentials
• •All C2 channels simultaneously neutralized in takedown

This summary was automatically generated by AI based on the original article and may not be fully accurate.