GlassWorm Goes Native: Same Infrastructure, Hardened Delivery
By Lotan Sery,,
Excerpt
GlassWorm is back. Again. Since we first exposed this campaign in October, we've seen two waves, over 45,000 victims, and one attacker who won't quit.
After our last disclosure, things went quiet for a few weeks. Then, on November 22, a familiar Solana wallet woke up with a fresh transaction and a new C2 IP. And within days, malicious extensions started appearing again. But this wave is different.
The invisible Unicode technique we exposed in our first report? Completely gone.
Instead, we found compiled Rust binaries. All the functionality we decoded from those invisible characters – Solana C2 lookups, AES decryption, payload staging – is now compiled into native code t…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Koi on koi.ai.
Mentioned in the excerpt1
More from Koi1
Koi · Web page · Published 6 Nov
GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure
Almost three weeks ago, we disclosed GlassWorm - the first self-propagating worm targeting VS Code extensions, using invisible Unicode characters to hide malicious code that literally disappears from code editors. On October 21, 2025, OpenVSX declared the…