GlassWorm attack Archives

An ongoing attack that uses the stolen GitHub tokens to insert malware into hundreds of Python repositories is being fueled by the GlassWorm malware campaign. By adding obfuscated code to files like setup.py, main.py, and app.py, the attack targets Python projects, including Django apps, ML research code, Streamlit dashboards, and PyPI packages, according to StepSecurity. The malware will be activated by anyone who clones and runs the code or runs pip install from a hacked repository. The software supply chain security firm claims that the first injections occurred on March 8, 2026. After gaining access to the developer accounts, the attackers use malicious code to rebase the most recent legitimate commits on the default branch of the targeted repositories. They then force-push the ...

The goal of a recent GlassWorm malware attack using exploited OpenVSX extensions is to steal developer credentials and configurations, crypto-wallet data, and passwords from macOS systems. After gaining access to the account of a reputable developer (oorzc), the threat actor distributed malicious updates containing the GlassWorm payload to four extensions that had received 22,000 downloads. The malicious code was concealed by "invisible" Unicode characters in GlassWorm assaults, which initially surfaced in late October and were used to steal developer account information and cryptocurrency wallets. Additionally, SOCKS proxying and VNC-based remote access are supported by the malware. GlassWorm affected Microsoft's official Visual Studio Code marketplace as well as OpenVSX read mo...

Tag: GlassWorm attack

GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos

New GlassWorm attack targets macOS via compromised OpenVSX extensions