Back Cybersecuritynews

ForceMemo Hijacks GitHub Accounts, Backdoors Hundreds of Python Repos via Force

Cybersecuritynews •Tushar Subhra Dutta • March 18, 2026

A new malware campaign tracked as ForceMemo is quietly compromising hundreds of GitHub accounts and injecting hidden malicious code into Python repositories, leaving almost no visible trace. The earliest confirmed infections date back to March 8, 2026, and the campaign is still active, with new repositories being hit each day. The attack targets a broad […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GlassWorm's ForceMemo Campaign Compromises Hundreds of Python Repositories The ForceMemo campaign, attributed to the GlassWorm threat actor, is actively targeting the Python open-source ecosystem by exploiting stolen GitHub tokens to inject obfuscated malware into numerous repositories. The attack vector involves compromising developer workstations through malicious VS Code and Cursor extensions, which harvest GitHub credentials. Once the attacker gains access, they force-push malicious code into critical files such as setup.py and main.py, effectively rewriting repository history and making detection difficult. The malware employs advanced obfuscation techniques and a novel blockchain-based command-and-control mechanism using the Solana network. Hundreds of repositories, including those related to Django and machine learning, have been compromised since the campaign began, with the earliest confirmed infections dating back to March 8, 2026. The campaign remains active, posing significant risks to developers and users who may unknowingly install compromised packages. 6 sources 70

Extracted Entities

ForceMemo Hijacks GitHub Accounts, Backdoors Hundreds of Python Repos via Force

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (1)