Back Thehackernews

GlassWorm Attack Uses Stolen GitHub Tokens to Force

Thehackernews •[email protected] (The Hacker News) • March 16, 2026

The GlassWorm malware campaign is being used to fuel an ongoing attack that leverages the stolen GitHub tokens to inject malware into hundreds of Python repositories. "The attack targets Python projects — including Django apps, ML research code, Streamlit dashboards, and PyPI packages — by appending obfuscated code to files like setup.py, main.py, and app.py," StepSecurity said. "Anyone who runs

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GlassWorm's ForceMemo Campaign Compromises Hundreds of Python Repositories The ForceMemo campaign, attributed to the GlassWorm threat actor, is actively targeting the Python open-source ecosystem by exploiting stolen GitHub tokens to inject obfuscated malware into numerous repositories. The attack vector involves compromising developer workstations through malicious VS Code and Cursor extensions, which harvest GitHub credentials. Once the attacker gains access, they force-push malicious code into critical files such as setup.py and main.py, effectively rewriting repository history and making detection difficult. The malware employs advanced obfuscation techniques and a novel blockchain-based command-and-control mechanism using the Solana network. Hundreds of repositories, including those related to Django and machine learning, have been compromised since the campaign began, with the earliest confirmed infections dating back to March 8, 2026. The campaign remains active, posing significant risks to developers and users who may unknowingly install compromised packages. 6 sources 70

Extracted Entities

GlassWorm Attack Uses Stolen GitHub Tokens to Force

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (4)

Tools (1)