* [Blog](https://www.paloaltonetworks.com.au/blog) * [Security Operations](https://www.paloaltonetworks.com.au/blog/security-operations/) * The Evolution of GlassWor... # The Evolution of GlassWorm: How a Known Threat is Rewriting its Playbook through GitHub [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2Fsecurity-operations%2Fglassworm-evolution%2F) [](https://twitter.com/share?text=The+Evolution+of+GlassWorm%3A+How+a+Known+Threat+is+Rewriting+its+Playbook+through+GitHub&url=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2Fsecurity-operations%2Fglassworm-evolution%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2Fsecurity-operations%2Fglassworm-evolution%2F&title=The+Evolution+of+GlassWorm%3A+How+a+Known+Threat+is+Rewriting+its+Playbook+through+GitHub&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com.au/blog/security-operations/glassworm-evolution/&ts=markdown) \[\](mailto:?subject=The Evolution of GlassWorm: How a Known Threat is Rewriting its Playbook through GitHub) Link copied By [Idan Dardikman](https://www.paloaltonetworks.com/blog/author/idan-dardikman/?ts=markdown "Posts by Idan Dardikman"), [Yuval Ronen](https://www.paloaltonetworks.com/blog/author/yuval-ronen/?ts=markdown "Posts by Yuval Ronen") and [Lotan Sery](https://www.paloaltonetworks.com/blog/author/lotan-sery/?ts=markdown "Posts by Lotan Sery") Nov 06, 2025 5 minutes [AES](https://www.paloaltonetworks.com/blog/tag/aes/?ts=markdown) [Agentic Endpoint Security](https://www.paloaltonetworks.com/blog/tag/agentic-endpoint-security/?ts=markdown) [Cortex AES](https://www.paloaltonetworks.com/blog/tag/cortex-aes/?ts=markdown) [Koi](https://www.paloaltonetworks.com/blog/tag/koi/?ts=markdown) ### Key Takeaways * \*\*Second OpenVSX Wave:\*\*Three additional OpenVSX extensions were compromised, resulting in an estimated 10,000 additional downloads. * **Cross-Platform Spread via GitHub:** GlassWorm leveraged stolen GitHub credentials to push malicious, seemingly AI-generated commits to repositories, expanding beyond marketplace extensions. * **Blockchain-Resilient C2 Routing:** The threat actor issued a new transaction on the Solana blockchain to update next-stage C2 payload locations without modifying the core C2 and exfiltration server IPs. * \*\*Attacker Infrastructure Exposure:\*\*Analysis of an exposed C2 server endpoint revealed harvested credentials from organizations spanning the US, Europe, Asia, and South America, as well as operational telemetry linked to Russian-speaking operators. ## History of GlassWorm On October 17, the Cortex AES team disclosed GlassWorm - the first self-propagating worm targeting VS Code extensions, using invisible Unicode characters to hide malicious code that literally disappears from code editors. On October 21, 2025, OpenVSX declared the incident "fully contained and closed." But on November 6, 2025 - sixteen days later - we detected a new wave of GlassWorm infections. Three more extensions compromised. A fresh Solana blockchain transaction providing new C2 endpoints. Same attacker infrastructure, still fully operational. But here's where this story gets more serious. We managed to access the attacker's server. What we found inside confirmed the real-world impact: a partial list of victims from around the world - the US, South America, Europe, Asia - including a major government entity from the Middle East. ![Wold map of GlassWorm victims](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/10/word-image-371196-1.png) Wold map of GlassWorm victims This isn't just about compromised extensions anymore. This is about real victims, critical infrastructure at risk, and a worm that's doing exactly what we warned it would do: spreading through the developer ecosystem. And it's not just OpenVSX. Developers have reported that GlassWorm has jumped to GitHub repositories, using AI-generated commits to hide its invisible payloads in what looks like legitimate code changes. ## Second Wave Attacks Target OpenVSX Extensions On November 6, 2025, Cortex AES risk engine flagged automatically three additional OpenVSX marketplace extensions displaying the distinct GlassWorm signature: 1. ai-driven-dev.ai-driven-dev (~3,300 downloads) 2. adhamu.history-in-sublime-merge (~4,000 downloads) 3. yasuyuky.transient-emacs (~2,400 downloads) Combined, these compromised packages added approximately 10,000 infected developer endpoints to the campaign's overall reach. The underlying execution mechanism remained consistent with original findings: malicious logic was obfuscated using unprintable Unicode sequences within the[software supply chain](https://www.paloaltonetworks.com/cyberpedia/dependency-chain-abuse-cicd-sec3). To human eyes, the code appeared as benign blank spaces inside the code editor; to JavaScript interpreters, the characters executed fully. To distribute stage-two payloads, the operator posted a fresh transaction to the Solana blockchain. Blockchain-based [command and control](https://stage.paloaltonetworks.com/cyberpedia/command-and-control-explained) infrastructure provides resilience: even if payload host servers are taken down, updating the transaction on the public ledger costs fractions of a cent and automatically redirects infected endpoints to new C2 locations. Despite the fresh blockchain routing transaction, the primary hosting and[data exfiltration](https://www.paloaltonetworks.com/cyberpedia/data-exfiltration) infrastructure remained unchanged: * Primary C2 Host: 199.247.10\[.\]166 * Data Exfiltration Endpoint: 199.247.13\[.\]106:80/wall ## Analysis of the Exposed C2 Server Following reporting from an independent security researcher regarding an exposed server endpoint, investigators gained visibility into the attacker's server infrastructure. ![World Map of Glassworm Victims](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/10/word-image-371196-2.jpeg) Figure 1: World Map of Glassworm Victims ### Exposed Victim Telemetry The server housed a partial snapshot of compromised endpoints. Stolen data included harvested credentials, system environment configurations, and active developer session tokens. * **Global Footprint:** Affected organizations were identified across the United States, South America, Europe, and Asia. * **Public Sector Impact:** Telemetry confirmed[credential theft](https://www.paloaltonetworks.com/cyberpedia/what-is-identity-security) affecting a major government entity in the Middle East. * **Developer Workstations:** Dozens of individual software engineers and corporate developer environments had active session tokens exfiltrated. ![Attacker's data extracted from the C2 server](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/10/word-image-371196-3.jpeg) Figure 2: Attacker's data extracted from the C2 server ### Attribution and Telemetry Findings Exfiltrated server logs and keylogger telemetry provided critical intelligence regarding operational security oversights: * **Language Context**: Keylogger logs and system configuration artifacts contained Russian-language system indicators. * **C2 Framework:** The infrastructure incorporated RedExt, an open-source browser extension C2 framework. * **Account Identifiers:** Investigators identified specific user IDs linked to cryptocurrency exchanges and messaging channels, which were shared with law enforcement authorities to assist attribution efforts. ## Campaign Expansion to GitHub Repositories Research published by Aikido Security on October 31, 2025, confirmed that GlassWorm had expanded beyond extension marketplaces into public and private GitHub repositories. Developers reported unauthorized repository commits that mimicked legitimate project modifications. The commits appeared to be generated using AI coding tools to blend naturally into standard code contributions. Embedded within these code changes were malicious payloads hidden via Private Use Area (PUA) Unicode encodings. Once executed, the decoded JavaScript invoked the same Solana-based C2 lookup mechanism observed in the extension-based campaign. By leveraging stolen developer access tokens, the malware automatically pushed infected code changes to other repositories under the developer's control, establishing self-propagating worm behavior. ## Indicators of Compromise (IOCs) The following indicators were identified during the November 2025 investigation. Network indicators have been defanged for safety. Compromised OpenVSX Extension Identifiers: * adhamu.history-in-sublime-merge@1.3.4 * yasuyuky.transient-emacs@0.23.1 * ai-driven-dev.ai-driven-dev@0.4.11 Command and Control Infrastructure: * 199\.247.10\[.\]166 (Primary C2 Server) * 199\.247.13\[.\]106:80/wall (Data Exfiltration Endpoint) ## Conclusion and Defensive Guidance The evolution of GlassWorm underscores the vulnerabilities inherent in modern developer workflows and ecosystem extensions. When malicious code relies on invisible characters, uses decentralized blockchains for C2 resilience, and propagates via legitimate source control platforms, traditional static analysis tools alone are insufficient. Securing the software supply chain requires continuous visibility across IDE extensions, developer credentials, and code repositories. Learn how[Cortex Agentic Endpoint Security](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security) provides unified governance across developer tools, build pipelines, and code repositories to stop threats before they propagate. *** ** * ** *** ## Related Blogs [#### Open Sesame: How a Fail-Open Bug in Open VSX's New Scanner Let Malware Walk Right In](https://www.paloaltonetworks.com.au/blog/security-operations/open-sesame-fail-open-bug-open-vsx-scanner/) [#### Supply Chain Under Siege: GlassWorm's Native Rust Loaders Target VS Code](https://www.paloaltonetworks.com.au/blog/security-operations/glassworm-goes-native-rust-loader-vscode-openvsx/) ### [Agent Security](https://www.paloaltonetworks.com/blog/ai-security/category/agent-security/?ts=markdown), [Agentic Identity Security](https://www.paloaltonetworks.com/blog/identity-security/category/agentic-identity-security/?ts=markdown), [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [AI Governance](https://www.paloaltonetworks.com/blog/ai-security/category/ai-governance/?ts=markdown), [AI Security](https://www.paloaltonetworks.com/blog/cloud-security/category/ai-security/?ts=markdown), [Announcement](https://www.paloaltonetworks.com/blog/cloud-security/category/announcement/?ts=markdown), [Assess AI Risks](https://www.paloaltonetworks.com/blog/ai-security/category/assess-ai-risks/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [News and Events](https://www.paloaltonetworks.com/blog/security-operations/category/news-and-events/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Secure AI Infrastructure](https://www.paloaltonetworks.com/blog/ai-security/category/secure-ai-infrastructure/?ts=markdown), [Secure GenAI Use](https://www.paloaltonetworks.com/blog/ai-security/category/secure-genai-use/?ts=markdown) [#### Your EDR is Blind to the Agentic Frontier](https://www.paloaltonetworks.com.au/blog/security-operations/your-edr-is-blind-to-the-agentic-frontier/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [News and Events](https://www.paloaltonetworks.com/blog/security-operations/category/news-and-events/?ts=markdown), [Partner Integrations](https://www.paloaltonetworks.com/blog/security-operations/category/partner-integrations/?ts=markdown), [Unkategorisiert](https://www.paloaltonetworks.com/blog/category/unkategorisiert/?lang=ja&ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### Fighting AI with AI: Palo Alto Networks and Tenzai Collaborate to Defeat Autonomous Threats](https://www.paloaltonetworks.com.au/blog/security-operations/fighting-ai-with-ai-palo-alto-networks-and-tenzai-collaborate-to-defeat-autonomous-threats/) ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown) [#### A 4X Gartner Magic Quadrant for EPP Leader. Built for the Agentic Era.](https://www.paloaltonetworks.com.au/blog/2026/05/a-4x-gartner-magic-quadrant-for-epp-leader-built-for-the-agentic-era/) [#### How Koi Protects Against Developer Supply Chains](https://www.paloaltonetworks.com.au/blog/security-operations/how-koi-protects-against-developer-supply-chains/) ### Subscribe to Security Operations Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com.au/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language