Related Threat Clusters
-
GlassWorm Malware Campaign Targets OpenVSX with 73 Malicious Extensions
A resurgence of the GlassWorm malware campaign has been identified, targeting the OpenVSX ecosystem with 73 'sleeper' extensions that become malicious after updates. Six of these extensions have already been activated…
8 articles · Updated April 27, 2026 -
Glassworm Botnet Targeting Developers Disrupted by CrowdStrike and Google
The Glassworm botnet, which has targeted software developers since early 2025, was taken down in a coordinated operation by CrowdStrike, Google, and the Shadowserver Foundation on May 26, 2026. This botnet utilized…
30 articles · Updated May 27, 2026 -
GlassWorm's ForceMemo Campaign Compromises Hundreds of Python Repositories
The ForceMemo campaign, attributed to the GlassWorm threat actor, is actively targeting the Python open-source ecosystem by exploiting stolen GitHub tokens to inject obfuscated malware into numerous repositories. The…
6 articles · Updated March 18, 2026 -
GlassWorm Campaign Expands with 72 Malicious Open VSX Extensions
The GlassWorm malware campaign has intensified its operations by utilizing 72 newly identified malicious Open VSX extensions. These extensions exploit transitive dependencies within developer environments, allowing the…
8 articles · Updated March 14, 2026 -
Firefox Bug CVE-2026-6770 Allows Tracking of Tor Users
A newly discovered vulnerability, CVE-2026-6770, allows attackers to fingerprint users of Firefox and Tor browsers, even in Private Browsing mode. The flaw, identified in the IndexedDB API, enables the creation of a…
3 articles · Updated April 27, 2026 -
GlassWorm Malware Resurfaces in Open VSX Extensions Following Token Leak
The Open VSX registry faced a supply chain attack after access tokens were leaked, allowing threat actors to publish malicious extensions. The GlassWorm malware campaign has returned with new extensions targeting…
15 articles · Updated November 11, 2025 -
GlassWorm Malware Resurfaces in Open VSX and GitHub
GlassWorm malware has reappeared on the Open VSX registry and in GitHub repositories, infecting three additional VS Code extensions. This resurgence follows its removal from the official marketplace, as reported by Koi…
6 articles · Updated November 10, 2025
Recent Intelligence Reports
- Coordinated operation takes down Glassworm botnet — Cybersecuritydive · May 27, 2026
- GlassWorm attackers activate new 'sleeper' extensions on Open VSX | news — Scworld · April 28, 2026
- GlassWorm malware attacks return via 73 OpenVSX "sleeper" extensions — Bleepingcomputer · April 27, 2026
- GlassWorm malware attacks return via 73 OpenVSX "sleeper" extensions — Bleepingcomputer · April 27, 2026
- Risky Bulletin: New fingerprinting technique can track Tor users — News.Risky.Biz · April 27, 2026
- GlassWorm campaign evolves: ForceMemo attack targets Python repos via stolen GitHub tokens — Scworld · March 18, 2026
- GlassWorm Campaign Uses 72 Malicious Open VSX Extensions to Broaden Reach — Cybersecuritynews · March 14, 2026
- GlassWorm Campaign Uses 72 Malicious Open VSX Extensions to Broaden Reach — Cybersecuritynews · March 14, 2026