RuntimeRebel — #GlassWormCybersecurity articles tagged #GlassWorm on RuntimeRebel.https://runtimerebel.comGlassworm Botnet Infrastructure Disrupted: Solana and DHT C2 Analysishttps://runtimerebel.com/blog/glassworm-botnet-infrastructure-disrupted-solana-and-dht-c2-analysishttps://runtimerebel.com/blog/glassworm-botnet-infrastructure-disrupted-solana-and-dht-c2-analysisResearchers disrupt the Glassworm botnet, which utilized Solana blockchain and BitTorrent DHT for resilient C2 to target software developers.Wed, 27 May 2026 17:12:49 GMTGlassWormSolana BlockchainBittorrent DhtSupply Chain AttackNpm MalwareGlassWorm Malware Takedown: Disruption of Developer Supply Chain C2https://runtimerebel.com/blog/glassworm-malware-takedown-disruption-of-developer-supply-chain-c2https://runtimerebel.com/blog/glassworm-malware-takedown-disruption-of-developer-supply-chain-c2CrowdStrike, Google, and Shadowserver disrupt the GlassWorm malware C2 infrastructure, halting a persistent developer-focused supply chain attack campaign.Wed, 27 May 2026 13:20:01 GMTGlassWormCrowdStrikeC2 DisruptionSupply Chain AttackMalicious PackagesGlassWorm Campaign Leverages Malicious VS Code Extensionshttps://runtimerebel.com/blog/glassworm-campaign-leverages-malicious-vs-code-extensionshttps://runtimerebel.com/blog/glassworm-campaign-leverages-malicious-vs-code-extensionsRuntime Rebel details the GlassWorm campaign, which infects developers via malicious Visual Studio Code extensions on Open VSX, facilitating a supply chain attack.Tue, 28 Apr 2026 16:45:38 GMTGlassWormVS CodeOpen VSXSupply Chain AttackMalwareDeveloper ToolsApplication SecurityGlassWorm Malware: Cloned Open VSX Extensions Target Developershttps://runtimerebel.com/blog/glassworm-malware-cloned-open-vsx-extensions-target-developershttps://runtimerebel.com/blog/glassworm-malware-cloned-open-vsx-extensions-target-developersOver 70 malicious Open VSX extensions cloned from popular tools deliver GlassWorm malware, highlighting risks in developer-focused supply chain attacks.Tue, 28 Apr 2026 12:45:16 GMTOpen VSXGlassWormVS CodeCheckmarxMalwareSupply Chain AttackGlassWorm Malware Resurfaces via 73 OpenVSX Sleeper Extensionshttps://runtimerebel.com/blog/glassworm-malware-resurfaces-via-73-openvsx-sleeper-extensionshttps://runtimerebel.com/blog/glassworm-malware-resurfaces-via-73-openvsx-sleeper-extensionsA new GlassWorm campaign exploits the OpenVSX ecosystem with 73 'sleeper' extensions, posing a significant supply chain threat to developers.Tue, 28 Apr 2026 00:50:03 GMTGlassWormOpen VSXSupply Chain AttackVisual Studio CodeSleeper ExtensionsMalwareGlassWorm Campaign: Zig Dropper Infects Developer IDEs via Open VSXhttps://runtimerebel.com/blog/glassworm-campaign-zig-dropper-infects-developer-ides-via-open-vsxhttps://runtimerebel.com/blog/glassworm-campaign-zig-dropper-infects-developer-ides-via-open-vsxThe GlassWorm campaign exploits the Open VSX registry with a malicious Zig-based dropper, impersonating WakaTime to compromise multiple developer IDEs.Fri, 10 Apr 2026 16:23:40 GMTGlassWormZig DropperOpen VSXIDE SecurityWakaTime SpoofingGlassWorm Malware Uses Solana Dead Drops for Stealthy C2 Deliveryhttps://runtimerebel.com/blog/glassworm-malware-uses-solana-dead-drops-for-stealthy-c2-deliveryhttps://runtimerebel.com/blog/glassworm-malware-uses-solana-dead-drops-for-stealthy-c2-deliveryGlassWorm evolves to use Solana blockchain metadata for C2 infrastructure, deploying a RAT and a malicious Google Docs Chrome extension to steal crypto data.Wed, 25 Mar 2026 16:31:31 GMTGlassWormSolanaRATInformation StealerBlockchain Dead DropsGlassWorm Supply Chain Attack: 400+ Malicious Repos Identifiedhttps://runtimerebel.com/blog/glassworm-supply-chain-attack-400-malicious-repos-identifiedhttps://runtimerebel.com/blog/glassworm-supply-chain-attack-400-malicious-repos-identifiedThe GlassWorm campaign hits GitHub, npm, and VSCode marketplaces with over 400 malicious repositories. Learn to detect and mitigate this supply chain threat.Wed, 18 Mar 2026 00:36:52 GMTGlassWormNPM SecurityVscode ExtensionsSupply Chain AttackMalware AnalysisGlassWorm Malware: Detecting Obfuscated Payloads in Browser Extensionshttps://runtimerebel.com/blog/glassworm-malware-detecting-obfuscated-payloads-in-browser-extensionshttps://runtimerebel.com/blog/glassworm-malware-detecting-obfuscated-payloads-in-browser-extensionsTechnical analysis of GlassWorm (ChromeLoader) evolution, detailing how the malware hides malicious JavaScript within legitimate browser extension dependencies.Tue, 17 Mar 2026 00:33:59 GMTGlassWormChromeLoaderBrowser SecurityJavascript ObfuscationInfostealerGlassWorm: Stolen GitHub Tokens Fuel Python Malware Injectionhttps://runtimerebel.com/blog/glassworm-stolen-github-tokens-fuel-python-malware-injectionhttps://runtimerebel.com/blog/glassworm-stolen-github-tokens-fuel-python-malware-injectionThe GlassWorm campaign uses stolen GitHub tokens to inject malicious code into Python repositories, including Django and machine learning projects.Mon, 16 Mar 2026 20:15:27 GMTGlassWormGitHub SecurityPython MalwareSupply Chain SecurityDjangoPyPIForceMemo: Credential Theft Compromises Python Repositorieshttps://runtimerebel.com/blog/forcememo-credential-theft-compromises-python-repositorieshttps://runtimerebel.com/blog/forcememo-credential-theft-compromises-python-repositoriesResearchers reveal ForceMemo, a campaign exploiting credentials stolen via GlassWorm to compromise hundreds of GitHub accounts and Python repositories.Mon, 16 Mar 2026 12:24:53 GMTForceMemoGlassWormGitHubPythonSupply Chain AttackCredential TheftGlassWorm Abuses Open VSX Registry in Supply-Chain Attackhttps://runtimerebel.com/blog/glassworm-abuses-open-vsx-registry-in-supply-chain-attackhttps://runtimerebel.com/blog/glassworm-abuses-open-vsx-registry-in-supply-chain-attackThe GlassWorm campaign exploits transitive dependencies in 72 Open VSX extensions to deliver malicious loaders into developer environments.Sat, 14 Mar 2026 16:10:23 GMTGlassWormOpen VSXSupply Chain AttackVS CodeMalware