GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure
CrowdStrike says it and partners disrupted all command-and-control channels used by GlassWorm, a supply chain campaign targeting developers.
Intelligence analysis by GPT-5.4 Mini
CrowdStrike, Google, and Shadowserver say they shut down the full C2 stack behind GlassWorm, a long-running campaign that abused VS Code extensions, npm and Python packages, and stolen developer credentials to spread.
A group of attackers hid bad software inside tools developers trust, like editor add-ons and code packages. Once a developer installed them, the attackers could peek at secrets and sometimes run more code on the machine.
The attackers also hid their control system in strange places, like a secret note inside a blockchain message and data stored in normal-looking web services. That made the bad software harder to shut down, like hiding a key in several locked boxes.
CrowdStrike and partners say they broke all those control paths at once. That helps stop the attackers from sending new orders to infected computers, which lowers the chance of more stolen code, passwords, and wallet keys.
Analysis
What happened
CrowdStrike says it worked with Google and the Shadowserver Foundation to disrupt every command-and-control channel tied to GlassWorm, a persistent campaign that has targeted software developers since at least early 2025. The operation is described as a software supply chain attack that used malicious packages and extensions to reach people with access to source code, cloud platforms, CI/CD pipelines, and package registries.
How the campaign spread
According to the article, GlassWorm used trojanized VS Code extensions published in both the Microsoft VS Code Marketplace and Open VSX, which meant it could reach users of VS Code forks such as Cursor, Positron, Windsurf, and VSCodium. The group also inserted malicious code into compromised npm and Python packages. Its payloads focused on credential harvesting, cryptocurrency wallet theft, and host profiling. Later versions reportedly used a WebSocket-based JavaScript RAT, GlassWormRAT, to steal browser data and run arbitrary code, including installing a Chrome extension that could collect screenshots, keystrokes, and clipboard content.
Why the takedown mattered
CrowdStrike says the campaign relied on four distinct C2 paths for resilience: Solana blockchain memo fields, BitTorrent DHT lookups, Google Calendar event titles, and direct access to commercial VPS servers. That layering was meant to make shutdowns harder by hiding the real infrastructure behind multiple indirection points. The article says the takedown neutralized all four channels at once, so infected systems can no longer receive new instructions or payloads.
CrowdStrike also says the activity likely came from Russia-based criminals, citing execution stops on CIS systems and Russian-language comments. The broader warning is that developer environments remain a high-value target because one compromised workstation can cascade into many downstream victims.
Key points
- CrowdStrike, Google, and Shadowserver say they disrupted all C2 channels used by GlassWorm.
- GlassWorm targeted developers through malicious VS Code extensions and compromised npm and Python packages.
- The malware aimed to steal credentials, crypto wallets, browser data, and other sensitive host information.
- The campaign used four different C2 layers, including Solana, BitTorrent DHT, Google Calendar, and VPS-hosted servers.
- CrowdStrike says the activity likely came from Russia-based cybercriminals.
