CrowdStrike, Google, and the Shadowserver Foundation have dismantled the Glassworm botnet. The operation targeted a network specifically focused on compromising software developers globally rather than just end-user products.
June 20, 2026 at 5:51 PM
CrowdStrike, Google, and the Shadowserver Foundation have dismantled the Glassworm botnet. The operation targeted a network specifically focused on compromising software developers globally rather than just end-user products.
A cybercrime campaign called GlassWorm is hiding malware in invisible characters and spreading it through software that millions of developers rely on
GlassWorm malware hides in invisible open-source code
A cybercrime campaign called GlassWorm is hiding malware in invisible characters and spreading it through software that millions of developers rely on
www.scientificamerican.com
March 21, 2026 at 12:18 PM
A cybercrime campaign called GlassWorm is hiding malware in invisible characters and spreading it through software that millions of developers rely on
it's bandcamp friday! pls listen to my album I'm really proud of it marigocchi.bandcamp.com/album/glassw...
glassworm, by Marigold Merrygoround
9 track album
marigocchi.bandcamp.com
December 5, 2025 at 9:00 PM
it's bandcamp friday! pls listen to my album I'm really proud of it marigocchi.bandcamp.com/album/glassw...
GlassWorm malware hides in invisible open-source code [via @sciam.bsky.social] 🧪🔍🐛💻👨💻
"a class of attacks called “Trojan Source,” which exploited #Unicode, the standard that computers use to represent text and symbols."
www.scientificamerican.com/article/glas...
#OpenSource #malware #GlassWorm
"a class of attacks called “Trojan Source,” which exploited #Unicode, the standard that computers use to represent text and symbols."
www.scientificamerican.com/article/glas...
#OpenSource #malware #GlassWorm
GlassWorm malware hides in invisible open-source code
A cybercrime campaign called GlassWorm is hiding malware in invisible characters and spreading it through software that millions of developers rely on
www.scientificamerican.com
March 22, 2026 at 8:24 PM
GlassWorm malware hides in invisible open-source code [via @sciam.bsky.social] 🧪🔍🐛💻👨💻
"a class of attacks called “Trojan Source,” which exploited #Unicode, the standard that computers use to represent text and symbols."
www.scientificamerican.com/article/glas...
#OpenSource #malware #GlassWorm
"a class of attacks called “Trojan Source,” which exploited #Unicode, the standard that computers use to represent text and symbols."
www.scientificamerican.com/article/glas...
#OpenSource #malware #GlassWorm
o mallware em caracteres invisíveis (glassworm)
September 26, 2026 at 2:02 PM
o mallware em caracteres invisíveis (glassworm)
my first album is live! if you've been enjoying the stuff i post in #marigomodular and ever wanted to listen to something longer from me here you go! marigocchi.bandcamp.com/album/glassw...
glassworm, by Marigold Merrygoround
9 track album
marigocchi.bandcamp.com
November 21, 2025 at 9:13 PM
my first album is live! if you've been enjoying the stuff i post in #marigomodular and ever wanted to listen to something longer from me here you go! marigocchi.bandcamp.com/album/glassw...
Glassworm / Chaoborus larva!! Active predator of water fleas, adults are little flies
June 13, 2024 at 6:56 PM
Glassworm / Chaoborus larva!! Active predator of water fleas, adults are little flies
Phantom midge, Chaoboridae. Fascinating to see how the individual eyes are arranged around the antennas🤯
#phantommidge #glassworm #insects #büschelmücke #macrophotography #diptera
#phantommidge #glassworm #insects #büschelmücke #macrophotography #diptera
October 27, 2023 at 11:44 AM
Phantom midge, Chaoboridae. Fascinating to see how the individual eyes are arranged around the antennas🤯
#phantommidge #glassworm #insects #büschelmücke #macrophotography #diptera
#phantommidge #glassworm #insects #büschelmücke #macrophotography #diptera
YIPPIE
GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX
The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, repositories, and extensions on GitHub, npm, and VSCode/OpenVSX extensions.
www.bleepingcomputer.com
March 23, 2026 at 7:26 PM
YIPPIE
v flattered by the response glassworm has gotten so far, it's nice to see a result from all the experiments and tinkering I've been doing the past 6 months. already excited to keep learning new things and making new sounds. marigocchi.bandcamp.com/album/glassw...
glassworm, by Marigold Merrygoround
9 track album
marigocchi.bandcamp.com
November 22, 2025 at 6:27 PM
v flattered by the response glassworm has gotten so far, it's nice to see a result from all the experiments and tinkering I've been doing the past 6 months. already excited to keep learning new things and making new sounds. marigocchi.bandcamp.com/album/glassw...
Are you still hiding if no one is looking?
People aren't reading the code at all—they'd see the weird decoder+eval—and machines can see that and also the private use code points.
Also, it's been public since May 2025 and GitHub/NPM/Microsoft have done nothing.
www.aikido.dev/blog/glasswo...
People aren't reading the code at all—they'd see the weird decoder+eval—and machines can see that and also the private use code points.
Also, it's been public since May 2025 and GitHub/NPM/Microsoft have done nothing.
www.aikido.dev/blog/glasswo...
Glassworm Returns: Invisible Unicode Malware Found in 150+ GitHub Repositories
The Glassworm supply chain attack is back. Researchers uncovered malware hidden in invisible Unicode characters across 150+ GitHub repositories, plus npm packages and VS Code extensions.
www.aikido.dev
March 16, 2026 at 2:07 PM
Are you still hiding if no one is looking?
People aren't reading the code at all—they'd see the weird decoder+eval—and machines can see that and also the private use code points.
Also, it's been public since May 2025 and GitHub/NPM/Microsoft have done nothing.
www.aikido.dev/blog/glasswo...
People aren't reading the code at all—they'd see the weird decoder+eval—and machines can see that and also the private use code points.
Also, it's been public since May 2025 and GitHub/NPM/Microsoft have done nothing.
www.aikido.dev/blog/glasswo...
The new glassworm supply chain attack is interessting, reminds me of AI model poisoning with invisible unicode characters.
The glassworm takes everything and the auto update of VS Code doesn't make it a better situation.
The glassworm takes everything and the auto update of VS Code doesn't make it a better situation.
October 22, 2025 at 12:38 PM
The new glassworm supply chain attack is interessting, reminds me of AI model poisoning with invisible unicode characters.
The glassworm takes everything and the auto update of VS Code doesn't make it a better situation.
The glassworm takes everything and the auto update of VS Code doesn't make it a better situation.
i haven't posted about my album in a lil bit, it's like a little ecosystem of sonic creatures, for your ears. marigocchi.bandcamp.com/album/glassw...
glassworm, by Marigold Merrygoround
9 track album
marigocchi.bandcamp.com
January 14, 2026 at 7:56 PM
i haven't posted about my album in a lil bit, it's like a little ecosystem of sonic creatures, for your ears. marigocchi.bandcamp.com/album/glassw...
CrowdStrike, Google shatter Glassworm botnet
CrowdStrike, Google shatter Glassworm botnet
Developer-targeted, supply-chain attacks all the rage these days
www.theregister.com
May 27, 2026 at 5:59 PM
CrowdStrike, Google shatter Glassworm botnet
It's Bandcamp Friday!
I'm still working on a new project that won't be ready for a bit but I have two albums of ambient modular noise for your ears. I appreciate the support and listens! marigocchi.bandcamp.com
I'm still working on a new project that won't be ready for a bit but I have two albums of ambient modular noise for your ears. I appreciate the support and listens! marigocchi.bandcamp.com
September 4, 2026 at 8:41 PM
It's Bandcamp Friday!
I'm still working on a new project that won't be ready for a bit but I have two albums of ambient modular noise for your ears. I appreciate the support and listens! marigocchi.bandcamp.com
I'm still working on a new project that won't be ready for a bit but I have two albums of ambient modular noise for your ears. I appreciate the support and listens! marigocchi.bandcamp.com
A new and ongoing supply-chain attack is targeting developers on the OpenVSX and Microsoft Visual Studio marketplaces with self-spreading malware called GlassWorm that has been installed an estimated 35,800 times.
Self-spreading GlassWorm malware hits OpenVSX, VS Code registries
A new and ongoing supply-chain attack is targeting developers on the OpenVSX and Microsoft Visual Studio marketplaces with self-spreading malware called GlassWorm that has been installed an estimated 35,800 times.
www.bleepingcomputer.com
October 20, 2025 at 4:13 PM
A new and ongoing supply-chain attack is targeting developers on the OpenVSX and Microsoft Visual Studio marketplaces with self-spreading malware called GlassWorm that has been installed an estimated 35,800 times.
-BadHost vulnerability bypasses authentication on AI infrastructure
-Hackers breach Lithuania's state registry
-Security firms take down Glassworm botnet
-CERT India releases strict patching guideline
-OnlyFans leak is fake
Newsletter: news.risky.biz/risky-bullet...
Podcast: risky.biz/RBNEWS569/
-Hackers breach Lithuania's state registry
-Security firms take down Glassworm botnet
-CERT India releases strict patching guideline
-OnlyFans leak is fake
Newsletter: news.risky.biz/risky-bullet...
Podcast: risky.biz/RBNEWS569/
May 27, 2026 at 9:33 AM
-BadHost vulnerability bypasses authentication on AI infrastructure
-Hackers breach Lithuania's state registry
-Security firms take down Glassworm botnet
-CERT India releases strict patching guideline
-OnlyFans leak is fake
Newsletter: news.risky.biz/risky-bullet...
Podcast: risky.biz/RBNEWS569/
-Hackers breach Lithuania's state registry
-Security firms take down Glassworm botnet
-CERT India releases strict patching guideline
-OnlyFans leak is fake
Newsletter: news.risky.biz/risky-bullet...
Podcast: risky.biz/RBNEWS569/
Blockchain infrastructure has progressed from “useless” to “actively harmful”
aiafterhours.substack.com/p/the-npm-ec...
aiafterhours.substack.com/p/the-npm-ec...
April 1, 2026 at 9:30 PM
Blockchain infrastructure has progressed from “useless” to “actively harmful”
aiafterhours.substack.com/p/the-npm-ec...
aiafterhours.substack.com/p/the-npm-ec...
The Glassworm botnet targeting developers in software supply-chain attacks has been disrupted after researchers took down its resilient command-and-control infrastructure relying on Solana blockchain transactions and the BitTorrent DHT network.
Glassworm botnet disrupted after resilient C2 infrastructure takedown
The Glassworm botnet targeting developers in software supply-chain attacks has been disrupted after researchers took down its resilient command-and-control infrastructure relying on Solana blockchain transactions and the BitTorrent DHT network.
www.bleepingcomputer.com
May 27, 2026 at 1:29 PM
The Glassworm botnet targeting developers in software supply-chain attacks has been disrupted after researchers took down its resilient command-and-control infrastructure relying on Solana blockchain transactions and the BitTorrent DHT network.
The Glassworm campaign, which first emerged on the OpenVSX and Microsoft Visual Studio marketplaces in October, is now in its third wave, with 24 new packages added on the two platforms.
Glassworm malware returns in third wave of malicious VS Code packages
The Glassworm campaign, which first emerged on the OpenVSX and Microsoft Visual Studio marketplaces in October, is now in its third wave, with 24 new packages added on the two platforms.
www.bleepingcomputer.com
December 1, 2025 at 9:08 PM
The Glassworm campaign, which first emerged on the OpenVSX and Microsoft Visual Studio marketplaces in October, is now in its third wave, with 24 new packages added on the two platforms.
A new GlassWorm malware attack through compromised OpenVSX extensions focuses on stealing passwords, crypto-wallet data, and developer credentials and configurations from macOS systems.
New GlassWorm attack targets macOS via compromised OpenVSX extensions
A new GlassWorm malware attack through compromised OpenVSX extensions focuses on stealing passwords, crypto-wallet data, and developer credentials and configurations from macOS systems.
www.bleepingcomputer.com
February 2, 2026 at 10:04 PM
A new GlassWorm malware attack through compromised OpenVSX extensions focuses on stealing passwords, crypto-wallet data, and developer credentials and configurations from macOS systems.
Google, CrowdStrike, and Shadowserver take down the Glassworm C&C servers
www.crowdstrike.com/en-us/blog/i...
www.crowdstrike.com/en-us/blog/i...
May 26, 2026 at 6:19 PM
Google, CrowdStrike, and Shadowserver take down the Glassworm C&C servers
www.crowdstrike.com/en-us/blog/i...
www.crowdstrike.com/en-us/blog/i...
"GlassWorm": multi-vector attack across VSCode extensions w/ invisible code, Solana C2, and GCal, turning your 'puter into a Zombie via SOCKS proxy and Hidden VNC.
Morbidly fascinating, b/c technically so well done.
www.koi.ai/blog/glasswo...
PS: do `$> code --list-extensions --show-versions` NOW
Morbidly fascinating, b/c technically so well done.
www.koi.ai/blog/glasswo...
PS: do `$> code --list-extensions --show-versions` NOW
GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace | Koi Blog
Back
www.koi.ai
October 22, 2025 at 10:03 AM
"GlassWorm": multi-vector attack across VSCode extensions w/ invisible code, Solana C2, and GCal, turning your 'puter into a Zombie via SOCKS proxy and Hidden VNC.
Morbidly fascinating, b/c technically so well done.
www.koi.ai/blog/glasswo...
PS: do `$> code --list-extensions --show-versions` NOW
Morbidly fascinating, b/c technically so well done.
www.koi.ai/blog/glasswo...
PS: do `$> code --list-extensions --show-versions` NOW
Cybercriminals used the Glassworm botnet to infect open source software projects with malware, and in turn hack the developers and companies that use that software.
CrowdStrike and Google take down botnet used by hackers to target software developers in supply chain attacks | TechCrunch
Cybercriminals used the Glassworm botnet to infect open source software projects with malware, and in turn hack the developers and companies that use that software.
techcrunch.com
May 27, 2026 at 5:05 PM
Cybercriminals used the Glassworm botnet to infect open source software projects with malware, and in turn hack the developers and companies that use that software.
Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware
Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware
Cybersecurity researchers have flagged dozens of Microsoft Visual Studio Code (VS Code) extensions on the Open VSX repository that are linked to a persistent information-stealing campaign dubbed GlassWorm.
The cluster of 73 extensions has been identified as cloned versions of their legitimate counterparts. Of these, six have been confirmed to be malicious, with the remaining acting as seemingly
thehackernews.com
April 27, 2026 at 12:32 PM
Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware