GlassWorm
According to Koi Security, this malware harvests NPM, GitHub, and Git credentials for supply chain propagation. It targets 49 different cryptocurrency wallet extensions to drain funds. It uses stolen credentials to compromise additional packages and extensions, spreading the worm further. Furthermore, it deploys SOCKS proxy servers, turning developer machines into criminal infrastructure and… Source: MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 21 Oct 2026 · last seen on 21 Oct 2026
News
- OVHcloud GitHub Compromise Tied to GlassWorm Threat ActorsDark Reading · 21 Oct 2026
MITRE ATT&CK techniques
Initial Access
Execution
Persistence
T1543.001Launch Agent 2 Sigma rulesT1547.001Registry Run Keys / Startup Folder 38 Sigma rulesT1554Compromise Host Software Binary 4 Sigma rules
Credential Access
T1539Steal Web Session Cookie 2 Sigma rulesT1555.001Keychain 1 Sigma rulesT1555.003Credentials from Web Browsers 6 Sigma rules
Discovery
T1082System Information Discovery 18 Sigma rulesT1124System Time Discovery 1 Sigma rulesT1217Browser Information DiscoveryT1518Software Discovery 9 Sigma rulesT1614System Location Discovery 2 Sigma rulesT1614.001System Language Discovery 2 Sigma rules
Collection
T1005Data from Local System 12 Sigma rulesT1074.001Local Data Staging 4 Sigma rulesT1213.003Code Repositories 4 Sigma rulesT1213.006DatabasesT1560.001Archive via Utility 10 Sigma rulesT1602.002Network Device Configuration Dump
Command and Control
T1008Fallback Channels 4 Sigma rulesT1071.001Web Protocols 39 Sigma rulesT1090.001Internal Proxy 6 Sigma rulesT1102.001Dead Drop Resolver 4 Sigma rulesT1105Ingress Tool Transfer 40 Sigma rulesT1571Non-Standard Port 5 Sigma rules
Impact
Stealth
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗ malpedia.caad.fkie.fraunhofer.de ↗