GlassWorm's Stealthy Crawl: Fake Extensions and Blockchain C2 Turn Dev Tools into Spyware Nightmares
Developers grabbed what looked like a routine npm update. Hours later, GlassWorm had turned their machines into crypto-stealing spies, complete with fake browser extensions watching every tab.
⚡ Key Takeaways
- GlassWorm uses Solana blockchain memos for dynamic, resilient C2— a new evasion standard.
- Fake 'Google Docs Offline' Chrome extension enables total browser surveillance, from DOM snapshots to keylogs.
- Targets developers for supply chain use; stolen tokens could cascade to enterprise-wide breaches.
🧠 What's your take on this?
Cast your vote and see what Threat Digest readers think
Worth sharing?
Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.
Originally reported by Malwarebytes Labs
Related Stories
Threat Intelligence
Unified Exposure Management: AI Hype or Real Shield?
Threat Intelligence
Quantum Cryptography's Inventors Snag Turing Award—But Does It Fix Anything Real?
Threat Intelligence
DeepLoad Malware: AI-Powered ClickFix Scam That's Already Stealing Enterprise Logins
Threat Intelligence