LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S9010: GlassWorm

GlassWorm is a worm that propagated through supply chain attacks by compromising repository credentials from victim environments and having malicious payloads added to those compromised accounts for distribution to victims across the various development ecosystems.[1][2][3] GlassWorm has numerous variants, including Rust binaries, encrypted JavaScript and a variant leveraging invisible Unicode characters that made reverse engineering difficult.[4][1][5] GlassWorm has employed a unique command and control (C2) methodology using Solana blockchain.[6][1] GlassWorm was first reported in October 2025.[6][1][3]

EnterpriseS9010MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

GlassWorm matters because it targets the software delivery chain rather than only individual endpoints. The supplied ATT&CK entry describes a worm that spread by compromising repository credentials and adding malicious payloads for distribution across development ecosystems, with variants using Rust binaries, encrypted JavaScript, invisible Unicode, and Solana blockchain-based C2. For leaders, this makes GlassWorm a risk to developer trust, release integrity, and incident scoping, especially where repository credentials, extensions, packages, and developer workstations are not monitored together.

Executive priority

Prioritize GlassWorm as a software supply chain and identity-control validation case. Key executive questions are: which repository credentials and tokens can publish code or packages; whether changes to dependencies, extensions, and repositories are auditable; whether macOS and Windows developer endpoints have sufficient telemetry; and whether incident response can quickly revoke credentials, validate source integrity, and determine downstream distribution exposure. This is also useful compliance evidence for access control, change management, logging, and secure development lifecycle controls.

Technical view

The object has no ATT&CK tactics specified and no official detection text, but its relationships indicate behavior spanning supply chain initial access, script execution, persistence, discovery, collection, credential access, stealth/obfuscation, and command-and-control. SOC and IR teams should validate coverage around compromised repository credentials, malicious dependency or development-tool updates, JavaScript and AppleScript execution, encrypted or encoded files, invisible Unicode in source or package content, macOS Launch Agents, Windows Run Keys or Startup Folder entries, local data staging, browser/session-cookie access, code repository and database collection, HTTP/S C2, fallback channels, dead-drop resolver behavior, internal proxying, and ingress tool transfer. Treat developer workstations, repository SaaS logs, package or extension publishing workflows, and outbound network telemetry as a combined detection surface rather than separate control domains.

Likely telemetry

  • Code repository audit logs: authentication events, token use, credential changes, publishing activity, commits, package or extension updates, and anomalous access to private repositories.
  • Developer endpoint telemetry on macOS and Windows: process creation, script interpreter activity, file writes, persistence locations, and security tool events.
  • macOS-specific telemetry: osascript or AppleScript execution and Launch Agent plist creation or modification.
  • Windows-specific telemetry: Registry Run Key changes, Startup Folder writes, script execution, and process ancestry for unexpected JavaScript/JScript activity.
  • Source, package, and artifact scanning results for encrypted or encoded content, invisible or non-printing Unicode characters, masqueraded files, and unexpected Rust binaries or JavaScript payloads.

Detection direction

  • Because MITRE provides no official detection guidance for this object, start with control validation mapped to the related techniques rather than assuming existing malware signatures are sufficient.
  • Correlate repository events with endpoint activity: suspicious publishing or commit activity should be reviewed alongside the developer host that held the credential or token.
  • Tune for developer-environment false positives: JavaScript, AppleScript, Rust binaries, package publishing, and repository access can be normal in engineering workflows, so detections should emphasize unusual process lineage, new persistence, encoded content, invisible Unicode, unexpected destinations, and credential use outside normal patterns.
  • Add review logic for invisible or non-printing Unicode in source code, package manifests, extensions, scripts, and build artifacts, since visual code review may miss this behavior.
  • Validate macOS and Windows persistence monitoring separately: Launch Agents on macOS and Run Keys or Startup Folder entries on Windows represent different evidence paths.

Mitigation priorities

  • Harden repository identity first: enforce least privilege for publishing rights, strong authentication, scoped and short-lived tokens where feasible, rapid token revocation, and review of dormant or over-privileged developer accounts.
  • Protect the software delivery path: require review and provenance checks for dependency, extension, package, and build artifact changes; monitor for unexpected maintainership or publishing changes.
  • Improve secure code and artifact review for obfuscation indicators, including encrypted or encoded payloads and invisible Unicode characters.
  • Strengthen developer endpoint controls on macOS and Windows, including monitoring and restriction of unauthorized persistence mechanisms, script execution abuse, and unexpected tool downloads.
  • Prepare IR playbooks for supply chain compromise: revoke repository credentials, preserve audit logs, validate affected commits/packages/extensions, identify downstream distribution, and coordinate rollback or notification decisions.
Additional notes and limits

This take is based only on the supplied ATT&CK software object, external references, and stated relationships. The strongest decision value is the intersection of software supply chain compromise, developer identity, endpoint persistence, obfuscated code, and C2 resilience. GlassWorm is officially listed for macOS and Windows in the supplied object; several related techniques include broader platforms, but those should be treated as technique context rather than confirmed GlassWorm platform scope.

The ATT&CK object provides no official detection text, no specified tactics on the software object, and no environment-specific indicators. The external references are listed but not expanded beyond the supplied descriptions. Local repository architecture, package ecosystems, developer endpoint baselines, token practices, and logging coverage are required to determine actual exposure and detection confidence.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

GlassWorm

GlassWorm is a worm that propagated through supply chain attacks by compromising repository credentials from victim environments and having malicious payloads added to those compromised accounts for distribution to victims across the various development ecosystems.[1][2][3] GlassWorm has numerous variants, including Rust binaries, encrypted JavaScript and a variant leveraging invisible Unicode characters that made reverse engineering difficult.[4][1][5] GlassWorm has employed a unique command and control (C2) methodology using Solana blockchain.[6][1] GlassWorm was first reported in October 2025.[6][1][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

36 rows
DomainIDNameRelationship / procedure
EnterpriseT1213.006DatabasesSub-technique

GlassWorm has collected data from macOS devices through the gathering of Apple Notes related files by targeting `/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`, `/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal`, and `/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm`.[3]

EnterpriseT1571Non-Standard Port

GlassWorm has distributed C2 using BitTorrent’s Distributed Hash Table (DHT) network to harness a decentralized command capability.[1]

EnterpriseT1480Execution Guardrails

GlassWorm has utilized logic to avoid executing on Russian based devices.[3]

EnterpriseT1124System Time Discovery

GlassWorm has the ability to check the system’s time zone on the victim device.[3]

EnterpriseT1560.001Archive via UtilitySub-technique

GlassWorm has archived collected files within a zip file prior to exfiltration to include `/tmp/out.zip`.[3]

EnterpriseT1071.001Web ProtocolsSub-technique

GlassWorm has used HTTP for C2 and extracts data from the HTTP response headers.[1]

EnterpriseT1543.001Launch AgentSub-technique

GlassWorm has established persistence on macOS via a LaunchAgent by writing a plist under `/library/LaunchAgents`.[4][3]

EnterpriseT1090.001Internal ProxySub-technique

GlassWorm has leveraged peer-to-peer software to facilitate communications within the victim network to include the software WebRTC.[1] GlassWorm has also established a SOCKS proxy to interact with victim devices that also acted as a proxy node for follow-on behaviors.[1]

EnterpriseT1602.002Network Device Configuration DumpSub-technique

GlassWorm has gathered data pertaining to VPN configurations.[4][3] GlassWorm has also targeted locally stored data on macOS located in `/Library/Application Support/Fortinet/FortiClient/conf/vpn.plist`.[3]

EnterpriseT1555.001KeychainSub-technique

GlassWorm has collected keys stored within `/Library/Keychains/login.keychain-db`.[4][3]

EnterpriseT1140Deobfuscate/Decode Files or Information

GlassWorm has decoded its Base64 instructions.[1] GlassWorm has also decrypted its AES protected payloads.[4][1][3]

EnterpriseT1678Delay Execution

GlassWorm has used a timeout function set to `9e5` which delays execution 900,000 milliseconds or 15 minutes to avoid detection.[4]

EnterpriseT1539Steal Web Session Cookie

GlassWorm has harvested Safari cookies stored within `/Library/Containers/com.apple.Safari/Data/Library/Cookies/ Cookies.binarycookies`.[3] GlassWorm has also stolen cookies within Chromium and Firefox browsers.[4][3]

EnterpriseT1102.001Dead Drop ResolverSub-technique

GlassWorm has leveraged blockchain-based C2 infrastructure to include Solana blockchain that contains additional C2 details within the memo field.[4][6][1][2][3][5] GlassWorm has also leveraged Google Calendar to host encoded data.[1][3][5]

EnterpriseT1213.003Code RepositoriesSub-technique

GlassWorm has gathered code repository authentication materials for NPM and GitHub.[4][1][3] GlassWorm has collected details pertaining to the npm configuration data for `_authToken`.[1][3]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

GlassWorm has gathered credentials stored in Mozilla FireFox and Chromium-based Browsers.[4][3]

EnterpriseT1005Data from Local System

GlassWorm has collected local data from a compromised host to include desktop cryptocurrency wallet data, and documents from within Desktop, Documents, and Downloads.[3]

EnterpriseT1564.003Hidden WindowSub-technique

GlassWorm has leveraged Hidden Virtual Network Computing (HVNC) to remain undetected and conduct execution of collection and communication actions.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

GlassWorm has leveraged AES-256-CBC encryption to obfuscate its malicious JavaScript payload.[4][1][3][5] GlassWorm has also utilized Base64 encoding to obfuscate the C2 details stored in the Solana memo field.[4][1][5]

EnterpriseT1657Financial Theft

GlassWorm has the ability to steal credentials for cryptocurrency wallets.[4][1][3]

EnterpriseT1036Masquerading

GlassWorm has masqueraded as legitimate VSCode extensions.[2][5] GlassWorm has also impersonated Github projects.[2]

EnterpriseT1195.001Compromise Software Dependencies and Development ToolsSub-technique

GlassWorm has spread through Visual Studio extensions.[1][2][3] GlassWorm has also spread through JavaScript projects hosted on Github.[2]

EnterpriseT1074.001Local Data StagingSub-technique

GlassWorm has staged collected data in a working directory within a temp folder to include `/tmp/ijewf`.[4][3]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

GlassWorm has set registry run keys for persistence in both `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\Software\Microsoft\Windows\CurrentVersion\Run\`.[1]

EnterpriseT1027.018Invisible UnicodeSub-technique

GlassWorm has utilized invisible Unicode Private Use Area (PUA) characters to obfuscate its malicious code so that it does not render in code editors.[4][1][2]

EnterpriseT1565.002Transmitted Data ManipulationSub-technique

GlassWorm can intercept and modify transaction details associated with hardware wallet applications before signing.[4]

EnterpriseT1614System Location Discovery

GlassWorm has leveraged geofencing logic to detect whether it is operating in a Russian associated time zone to determine whether it continues to execute.[3]

EnterpriseT1059.002AppleScriptSub-technique

GlassWorm has utilized AppleScript to include `set keychainPassword to do shell script` to execute shell command that retrieves passwords from the macOS keychain.[4]

EnterpriseT1059.007JavaScriptSub-technique

GlassWorm has leveraged JavaScript to execute its malicious code to include its hidden Unicode characters using the `eval` call.[6][1][2][3] GlassWorm has also utilized encrypted payloads compiled in JavaScript.[4]

EnterpriseT1614.001System Language DiscoverySub-technique

GlassWorm has identified the system language settings by checking for `ru_RU`, `ru-RU`, `ru`, and `Russian` to prevent execution in a Russian associated device.[3]

EnterpriseT1217Browser Information Discovery

GlassWorm has searched browser data for cookies, history, login databases, and cryptocurrency wallets.[3]

EnterpriseT1008Fallback Channels

GlassWorm has utilized Google Calendar as backup C2.[1][5]

EnterpriseT1082System Information Discovery

GlassWorm has the ability to check the OS of the victim host.[3][5] GlassWorm has checked whether the OS platform value includes `darwin` prior to execution of macOS specific scripts.[3][5]

EnterpriseT1554Compromise Host Software Binary

GlassWorm can modify hardware wallet applications.[4]

EnterpriseT1518Software Discovery

GlassWorm has searched for existing wallet applications to include Ledger Live and Trezor Suite.[4]

EnterpriseT1105Ingress Tool Transfer

GlassWorm has downloaded additional payloads from C2.[4][6][3][5]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1213.006: DatabasesEnterpriseuses · TechniqueT1571: Non-Standard PortEnterpriseuses · TechniqueT1480: Execution GuardrailsEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1560.001: Archive via UtilityEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1543.001: Launch AgentEnterpriseuses · TechniqueT1090.001: Internal ProxyEnterpriseuses · TechniqueT1602.002: Network Device Configuration DumpEnterpriseuses · TechniqueT1555.001: KeychainEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1678: Delay ExecutionEnterpriseuses · TechniqueT1539: Steal Web Session CookieEnterpriseuses · TechniqueT1102.001: Dead Drop ResolverEnterpriseuses · TechniqueT1213.003: Code RepositoriesEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1657: Financial TheftEnterpriseuses · TechniqueT1036: MasqueradingEnterpriseuses · TechniqueT1195.001: Compromise Software Dependencies and Development ToolsEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
b47c79ee879661c3...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundleb47c79ee8796…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  2. [2]
    Aikido GlassWorm October 2025

    Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.

    Open source URL
  3. [3]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  4. [4]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  5. [5]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  6. [6]
    Koi Glassworm Extensions November 2025

    Idan Dardikman, Yuval Ronen, Lotan Sery. (2025, November 6). GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure. Retrieved April 10, 2026.

    Open source URL
  7. [7]
    Aikido GlassWorm October 2025

    Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.

    Open source URL
  8. [8]
    Aikido GlassWorm October 2025

    Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.

    Open source URL
  9. [9]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  10. [10]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  11. [11]
    Koi Glassworm Extensions November 2025

    Idan Dardikman, Yuval Ronen, Lotan Sery. (2025, November 6). GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure. Retrieved April 10, 2026.

    Open source URL
  12. [12]
    Koi Glassworm Extensions November 2025

    Idan Dardikman, Yuval Ronen, Lotan Sery. (2025, November 6). GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure. Retrieved April 10, 2026.

    Open source URL
  13. [13]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  14. [14]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  15. [15]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  16. [16]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  17. [17]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  18. [18]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  19. [19]
    mitre-attackS9010
    Open source URL
  20. [20]
    mitre-attackS9010
    Open source URL
  21. [21]
    mitre-attackS9010
    Open source URL
  22. [22]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  23. [23]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  24. [24]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  25. [25]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  26. [26]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  27. [27]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  28. [28]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  29. [29]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  30. [30]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  31. [31]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  32. [32]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  33. [33]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  34. [34]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  35. [35]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  36. [36]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  37. [37]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  38. [38]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  39. [39]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  40. [40]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  41. [41]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  42. [42]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  43. [43]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  44. [44]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  45. [45]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  46. [46]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  47. [47]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  48. [48]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  49. [49]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  50. [50]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  51. [51]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  52. [52]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  53. [53]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  54. [54]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  55. [55]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  56. [56]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  57. [57]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  58. [58]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  59. [59]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  60. [60]
    Aikido GlassWorm October 2025

    Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.

    Open source URL
  61. [61]
    Aikido GlassWorm October 2025

    Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.

    Open source URL
  62. [62]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  63. [63]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  64. [64]
    Koi Glassworm Extensions November 2025

    Idan Dardikman, Yuval Ronen, Lotan Sery. (2025, November 6). GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure. Retrieved April 10, 2026.

    Open source URL
  65. [65]
    Koi Glassworm Extensions November 2025

    Idan Dardikman, Yuval Ronen, Lotan Sery. (2025, November 6). GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure. Retrieved April 10, 2026.

    Open source URL
  66. [66]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  67. [67]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  68. [68]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  69. [69]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  70. [70]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  71. [71]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  72. [72]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  73. [73]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  74. [74]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  75. [75]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  76. [76]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  77. [77]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  78. [78]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  79. [79]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  80. [80]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  81. [81]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  82. [82]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  83. [83]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  84. [84]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  85. [85]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  86. [86]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  87. [87]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  88. [88]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  89. [89]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  90. [90]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  91. [91]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  92. [92]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  93. [93]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  94. [94]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  95. [95]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  96. [96]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  97. [97]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  98. [98]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  99. [99]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  100. [100]
    Aikido GlassWorm October 2025

    Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.

    Open source URL
  101. [101]
    Aikido GlassWorm October 2025

    Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.

    Open source URL
  102. [102]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  103. [103]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  104. [104]
    Aikido GlassWorm October 2025

    Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.

    Open source URL
  105. [105]
    Aikido GlassWorm October 2025

    Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.

    Open source URL
  106. [106]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  107. [107]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  108. [108]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  109. [109]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  110. [110]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  111. [111]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  112. [112]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  113. [113]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  114. [114]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  115. [115]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  116. [116]
    Aikido GlassWorm October 2025

    Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.

    Open source URL
  117. [117]
    Aikido GlassWorm October 2025

    Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.

    Open source URL
  118. [118]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  119. [119]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  120. [120]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  121. [121]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  122. [122]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  123. [123]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  124. [124]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  125. [125]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  126. [126]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  127. [127]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  128. [128]
    Aikido GlassWorm October 2025

    Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.

    Open source URL
  129. [129]
    Aikido GlassWorm October 2025

    Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.

    Open source URL
  130. [130]
    Koi Glassworm Extensions November 2025

    Idan Dardikman, Yuval Ronen, Lotan Sery. (2025, November 6). GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure. Retrieved April 10, 2026.

    Open source URL
  131. [131]
    Koi Glassworm Extensions November 2025

    Idan Dardikman, Yuval Ronen, Lotan Sery. (2025, November 6). GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure. Retrieved April 10, 2026.

    Open source URL
  132. [132]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  133. [133]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  134. [134]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  135. [135]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  136. [136]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  137. [137]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  138. [138]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  139. [139]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  140. [140]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  141. [141]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  142. [142]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  143. [143]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  144. [144]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  145. [145]
    Koi Glassworm InvisibleCode October 2025

    Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.

    Open source URL
  146. [146]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  147. [147]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  148. [148]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  149. [149]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  150. [150]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  151. [151]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  152. [152]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  153. [153]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  154. [154]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  155. [155]
    Koi GlassWorm Rust December 2025

    Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.

    Open source URL
  156. [156]
    Koi Glassworm Extensions November 2025

    Idan Dardikman, Yuval Ronen, Lotan Sery. (2025, November 6). GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure. Retrieved April 10, 2026.

    Open source URL
  157. [157]
    Koi Glassworm Extensions November 2025

    Idan Dardikman, Yuval Ronen, Lotan Sery. (2025, November 6). GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure. Retrieved April 10, 2026.

    Open source URL
  158. [158]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  159. [159]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  160. [160]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  161. [161]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use