# GlassWorm: Stolen GitHub Tokens Fuel Python Malware Injection

> The GlassWorm campaign uses stolen GitHub tokens to inject malicious code into Python repositories, including Django and machine learning projects.

- Published: 2026-03-16T20:15:27.000Z
- Severity: high
- Category: Supply Chain
- Tags: GlassWorm, GitHub Security, Python Malware, Supply Chain Security, Django, PyPI
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/03/glassworm-attack-uses-stolen-github.html
- Canonical: https://runtimerebel.com/blog/glassworm-stolen-github-tokens-fuel-python-malware-injection

## Key points

- GlassWorm leverages stolen credentials to inject malicious code into hundreds of critical Python-based repositories and software projects.
- Affected systems include Python projects such as Django applications, machine learning research, Streamlit dashboards, and packages hosted on PyPI.
- Defenders must rotate all GitHub personal access tokens and implement fine-grained permissions to minimize the impact of credential theft.

The GlassWorm campaign represents a targeted [Supply Chain Attack](/glossary#supply-chain-attack) focusing on the Python ecosystem. Security researchers at StepSecurity, as reported by [The Hacker News](https://thehackernews.com/2026/03/glassworm-attack-uses-stolen-github.html), identified that the campaign utilizes compromised GitHub tokens to gain unauthorized write access to hundreds of repositories. The attackers perform force-pushes to overwrite legitimate project histories with malicious code, effectively poisoning the development pipeline for various Python projects.

## Technical Analysis of GlassWorm TTPs

The [TTP](/glossary#ttp) employed by the GlassWorm actors involves a systematic exploitation of developer credentials. By obtaining GitHub personal access tokens, often through [Phishing](/glossary#phishing) or previous data leaks, the attackers bypass traditional perimeter defenses. Once they possess a token with sufficient permissions, they target specific files within Python repositories that are executed during installation or standard application runtime.

The primary targets for code injection include `setup.py`, `main.py`, and `app.py`. The injected code is typically obfuscated to evade basic static analysis tools. In many cases, the malware is designed to establish a [C2](/glossary#c2) connection, allowing the attackers to exfiltrate sensitive environment variables or install additional payloads. The scope of this campaign is particularly broad, affecting Django applications, machine learning (ML) research code, Streamlit dashboards, and several packages intended for the Python Package Index (PyPI). This wide-reaching impact makes [securing Python Django apps from supply chain attacks](/glossary#supply-chain-attack) a priority for DevOps teams.

### How to Detect GlassWorm Malware Injection in Python Repositories

Identifying these injections requires a combination of automated monitoring and manual audit. Since the attackers use force-pushes, security teams should monitor for unexpected `git push --force` events in their audit logs, especially those originating from unusual IP addresses or outside of standard maintenance windows. Organizations should also perform regular integrity checks of their `setup.py` and `main.py` files. Any sudden appearance of Base64 encoded strings or complex obfuscation logic in these files is a high-confidence [IoC](/glossary#ioc).

Furthermore, developers should inspect their GitHub account security settings to identify any active personal access tokens that are no longer needed or were not created by them. Because the GlassWorm campaign specifically targets the Python ecosystem, any unusual activity in repository secrets or environment variables for CI/CD pipelines should be treated as a potential compromise. Integrating [EDR](/glossary#edr) tools into development environments can also assist in detecting the execution of malicious scripts during the testing phase of a project.

## Remediation and Prevention Strategies

To mitigate the risk of this campaign, organizations must transition away from long-lived, broad-scope credentials. Implementing [GitHub personal access token security best practices](/glossary#supply-chain-attack) is the most effective defense. This includes using fine-grained tokens that are limited to specific repositories and only grant the minimum necessary permissions required for the task.

Recommended actions for immediate defense:

*   **Token Rotation:** Revoke and reissue all active GitHub personal access tokens (PATs), ensuring that new tokens have expiration dates and restricted scopes.
*   **Enforce MFA:** Mandatory Multi-Factor Authentication (MFA) must be enforced across the entire GitHub organization to prevent account takeovers via password spraying.
*   **Branch Protection:** Enable branch protection rules to prevent force-pushes on primary branches (e.g., `main` or `master`). This forces attackers to create pull requests, which can then be scrutinized through mandatory code reviews.
*   **Secret Scanning:** Utilize GitHub’s native secret scanning or third-party tools to ensure that no tokens are accidentally committed to public or private repositories.

By adopting a [Zero Trust](/glossary#zero-trust) approach to developer credentials, organizations can significantly reduce the attack surface available to the GlassWorm actors and prevent the unauthorized modification of critical software assets.

**Related:** [Autonomous Agentic Coercion in Open-Source Ecosystems](/blog/autonomous-agentic-coercion-in-open-source-ecosystems), [Strategic Board Oversight: Supply Chain, AI, and Regulatory Risks](/blog/strategic-board-oversight-supply-chain-ai-and-regulatory-risks)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/glassworm-stolen-github-tokens-fuel-python-malware-injection