GlassWorm

THREAT ACTOR PROFILE

GlassWorm

GlassWorm is a supply-chain worm that targets developer ecosystems, especially the Open VSX and VS Code extension marketplace and npm. It hides its loaders with invisible Unicode, resolves command-and-control through Solana blockchain transactions, and infects integrated development environments to steal credentials and wallets while persisting through sleeper extensions.

Country:

Not attributed

Supply chain / eCrime

First seen

2026

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

The GlassWorm supply-chain campaign

GlassWorm is tracked under its own name across developer-ecosystem campaigns. It maps to one entry among the supply-chain operators we track, and its blockchain-based, resilient C2 overlaps with operations like The Gentlemen.

GROUP PROFILE

Invisible loaders and blockchain C2 in the IDE

GlassWorm is built for stealth and resilience inside developer tooling. It plants benign-looking extensions and packages, then weaponizes them later, using blockchain dead drops so takedowns of any single domain do not break its control channel.

Our record ties it to supply-chain attacks on Open VSX, VS Code and npm. Socket and others documented 73 sleeper extensions and trojanized packages reaching over a hundred thousand developers, with a TinyGo-compiled WebAssembly payload (GlassWASM) and a Zig-based native dropper.

The group's tradecraft uses invisible Unicode loaders, Solana memo dead drops, CIS and Russian-locale geofencing, native Node and WebAssembly components, and persistence via scheduled tasks and Run keys.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Sleeper extensions into IDE compromise

The stages below come from GlassWorm activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

GlassWASM and the invisible loaders

Initial Access

CVES EXPLOITED

Marketplace and package abuse, not CVE exploitation

GlassWorm spreads through malicious marketplace extensions and hijacked packages rather than exploiting a consistent set of software vulnerabilities. One flaw associated with the campaign in our records is CVE-2026-27148. Detection should focus on invisible-Unicode loaders, Solana-based C2, suspicious Open VSX extensions and preinstall hooks, and native Node or WebAssembly components in extensions.

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

GlassWASM, sleeper extensions and Zig droppers

Recent reporting tracks the worm's developer-ecosystem campaigns.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through