GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure
CrowdStrike, working alongside Google and the Shadowserver Foundation, announced a coordinated operation that took down every command-and-control (C2) channel tied to the GlassWorm campaign. The disruption cuts off the infrastructure used by a long-running operation that has been focusing on software developers since at least early 2025.
The attackers behind GlassWorm have concentrated on developers because their workstations and accounts can provide access to source code repositories, cloud services, continuous integration/continuous deployment (CI/CD) pipelines, and package registries. Compromising a single developer environment can therefore be leveraged to reach thousands of downstream customers and users through the software supply chain.
Since its discovery last year, GlassWorm has relied on multiple infection vectors. The campaign pushed trojanized Visual Studio Code extensions onto both the Microsoft VS Code Marketplace and the Open VSX registry, allowing the adversary to reach not just VS Code users but also those on VS Code forks such as Cursor, Positron, Windsurf, and VSCodium. In addition to malicious extensions, operators have also introduced tainted code via hijacked npm and Python packages.
The ultimate objective of these infections has been to install a modular data-stealing framework capable of harvesting credentials, exfiltrating cryptocurrency wallets, and profiling compromised hosts. Later variants of the malware family deploy a JavaScript remote access trojan, dubbed GlassWormRAT, which communicates over WebSocket to siphon browser data and execute arbitrary commands on victims’ machines. In many cases the attackers also push a malicious Google Chrome extension designed to capture screenshots, record keystrokes, and grab clipboard contents.
Endor Labs researcher Kiran Raj explained that once the malware is active it hunts for developer credentials - including GitHub, npm and OpenVSX tokens, as well as crypto wallet secrets - enabling attackers to take over repositories and push malicious packages. Infected systems are then repurposed as covert infrastructure: SOCKS proxies, hidden VNC (HVNC) servers, and remote execution nodes created via WebRTC channels or by spawning Node.js processes. This gives the operators anonymized access into corporate and personal networks and provides platforms for further spread.
CrowdStrike says the campaign has already used stolen developer credentials to taint more than 300 GitHub repositories. What set GlassWorm apart was its multi-layered resilience: the operators ran four separate C2 channels and used a mix of blockchain, peer-to-peer mechanisms, and legitimate web services as resolution layers to mask and protect the true C2 servers behind multiple indirections.
The coordinated takedown simultaneously neutralized all four of those channels so infected hosts can no longer receive new instructions or payloads from the attacker-controlled infrastructure. CrowdStrike characterized the operators as well-funded and persistent, and noted indicators that point to likely Russia-based cybercriminals - the malware self-terminates on systems in Commonwealth of Independent States (CIS) countries and contains Russian-language code comments.
In its assessment, CrowdStrike warned that the software supply chain remains one of the most consequential attack surfaces in modern computing. Attackers are increasingly weaponizing organizations’ dependencies on tools, libraries, and updates to amplify impact. With a low barrier to injecting malicious packages or extensions and a potentially vast blast radius, under-protected developer environments, build pipelines, and code repositories create systemic risk: any organization that consumes software inherits the exposure of its producers. GlassWorm demonstrates that adversaries are investing in robust, resilient infrastructure to retain persistent access to developer ecosystems.