GlassWorm Supply Chain Worm Uses Invisible Unicode and Solana Blockchain for Stealth C2

Cybersecurity researchers at Koi Security have uncovered GlassWorm, the world’s first self-propagating malware targeting VS Code extensions on the OpenVSX Marketplace, which combines invisible Unicode injection with a Solana blockchain-based C2 and Google Calendar as a backup channel. The campaign, active as of 19 October 2025, has compromised at least 35,800 installations, with seven OpenVSX extensions compromised on 17 October 2025 and ten extensions still actively distributing malware.

Once decoded, the Solana payload directs the infected hosts to a blockchain-based command and control system, making takedowns difficult since new transactions can point to fresh payloads even if a domain or IP is blocked. Additional credentials are hunted across NPM, GitHub, OpenVSX, and 49 cryptocurrency wallet extensions, and decryption reveals ZOMBI, a multi-functional RAT that enables proxying, hidden remote desktop access, and decentralized payload distribution.

The attack is characterised by autonomous replication, with stolen credentials used to compromise more packages and extensions automatically, creating an exponential growth model across the software development ecosystem. Researchers emphasise that this is an active, evolving threat, not a theoretical scenario.