New malware GlassWorm, BlackMamba and the new wave of cyber threats

The landscape of new malware circulating within the developer and tech ecosystem is changing at a breakneck pace. We're not just talking about "classic" Trojans, but also campaigns like GlassWorm, proof-of-concept attacks like BlackMamba, and malware families that leverage fileless techniques, advanced encryption, artificial intelligence, and unconventional command and control channels such as the Solana blockchain or enterprise collaboration applications.

In this context, terms like GlassWorm, polymorphic malware, AI-generated keyloggers , and malicious VS Code extensions have gone from being technical curiosities to a very real problem for developers, organizations, and even governments. Below, we break down in detail what's happening, how these threats work, and why they demand a change in mindset regarding how to protect the software supply chain.

GlassWorm: the invisible worm that sneaks into extensions and repositories

GlassWorm has established itself as one of the first worms specifically targeting the developer ecosystem , with a particular focus on VS Code extensions, GitHub repositories, and registries like npm and OpenVSX. Its initial distinguishing feature was the use of invisible Unicode characters to conceal malicious code within JavaScript and TypeScript files without anything unusual being immediately apparent in the editor.

The trick is to take advantage Unicode Private Use Area (PUA) characters and variation modifiers that editors represent as whitespace, but which actually encode bytes. A small decoder iterates through the contents of a seemingly empty string, converts those code points into valid numeric values, puts them into a buffer, and finally calls eval() to execute the already decoded payload.

From a developer's perspective, the suspicious fragment is usually camouflaged among seemingly innocuous changes: minor refactorings, small documentation tweaks, or version bumps . The commit doesn't raise any red flags, and the injection itself is often hidden within a utility file or a shared helper, making it easy to miss during manual code reviews.

The first waves of this campaign, tracked by various security firms , demonstrated that the invisible Unicode technique was sufficient to bypass reviews, linters, and many automated tools . The result: popular repositories compromised, extensions infected, and a perfect attack surface for spreading malware to anyone who installed or cloned those projects.

In parallel, it was observed how the threat actor behind GlassWorm was moving between ecosystems: first OpenVSX and VS Code, then GitHub, then npm and back again to extension marketplaces , following a very clear pattern of wave attacks, each one more sophisticated than the previous one.

Chained campaigns: from invisible Unicode to Rust binaries and encrypted payloads

As analysts published technical reports detailing GlassWorm's methods, the attacker responded by modifying the TTPs (tactics, techniques, and procedures) within weeks . This evolution has unfolded in several "waves," each with its own nuances but with a clearly shared infrastructure and objectives.

In the initial waves, the main threat came from payloads hidden within invisible Unicode characters embedded in VS Code and OpenVSX extensions. Once decoded, the malicious code typically downloaded a second script using the Solana blockchain as a distribution channel, capable of stealing credentials, developer secrets, and cryptocurrency wallet data.

Later, the actor moved to binaries compiled in Rust , leaving behind the most obvious part of the Unicode trick. These binaries incorporated more complex logic, including data theft capabilities, SOCKS proxies, and remote access channels via VNC, all launched from the developer's environment after installing a seemingly legitimate extension.

In a fourth wave, the approach changed again: the payload began arriving as JavaScript code with content encrypted using AES-256-CBC , embedded in compiled OpenVSX extension files. The key and initialization vector (IV) were hardcoded within the code itself, shared among several extensions, pointing to a single operator behind the campaign.

To top it all off, the attacker included a very specific tactic to evade sandboxes: a delay of about 900.000 milliseconds (around 15 minutes) before executing any malicious action . Many automated analysis environments stop execution after a few minutes, so the extension appeared harmless during the observation period, passing through the filters without raising suspicion.

Jump to macOS: GlassWorm goes where the developers are

One of GlassWorm's most worrying developments has been its shift in focus from Windows systems to an almost exclusive target of macOS , especially in recent campaigns. This makes perfect sense: a large proportion of developers, particularly in cryptocurrency, web3, and startup environments, use Macs as their primary workstations.

Instead of PowerShell or tinkering with the Windows Registry, newer GlassWorm variants employ AppleScript to stealthily execute actions and use LaunchAgents as a persistence mechanism, ensuring that the malicious payload runs on every login of the compromised user.

The malware focuses on stealing extremely sensitive information from macOS : keychain databases (login.keychain-db), stored passwords, Apple Notes, Safari cookies, data from Chromium and Firefox-based browsers, file system documents that appear to contain development secrets, and more.

Additionally, the payload collects developer credentials and project data, including GitHub tokens, credentials stored in git caches, npm tokens from the file .npmrc, SSH keys of the directory ~/.ssh and VPN configurations. All of this is packaged into a temporary folder, compressed, and exfiltrated to servers controlled by the attacker.

The command and control (C2) infrastructure maintains a consistent pattern: using the Solana blockchain to publish notes or memos with base64-encoded URLs that point to the current servers. The endpoints can be changed as often as the attacker wants; they simply need to publish a new memo on the blockchain. Because the Solana registry is immutable and decentralized, it is virtually impossible to take down in the same way one would with a traditional domain.

Trojanizing hardware wallets: the next level

One of the most serious developments in the latest waves of GlassWorm is its ability to replace hardware wallet applications with Trojanized versions . The malicious code specifically searches for installers or executables of applications like Ledger Live and Trezor Suite on the user's system.

If it finds them, the malware attempts to download a malicious version of those applications from the attacker's servers , deletes the legitimate application, and leaves the manipulated variant installed. To prevent an incomplete download from revealing the intrusion, the code includes minimum size checks (for example, files below a certain threshold are not installed), revealing a remarkable degree of care on the part of the attacker.

This approach opens the door to highly sophisticated attacks against the crypto ecosystem: an altered wallet application could display fake receiving addresses, modify transaction details before the user signs on the physical device, capture seed phrases during “recovery” processes, or intercept communication between the hardware device and the software.

At the time of some analyses, the C2 servers were returning empty files for the supposedly Trojanized applications , suggesting that the attacker was still preparing the payloads or migrating the infrastructure. However, the other functionalities—credential theft, data exfiltration, and macOS persistence—were fully operational.

Beyond hardware wallets, the malware continues to spread to dozens of browser and desktop wallets : MetaMask, Phantom, Coinbase Wallet, Exodus, Keplr, Solflare, Trust Wallet, Rabby, Electrum, Coinomi, Atomic, Bitcoin Core clients, Monero, and others. The intention is clear: to compromise as many funds as possible on each infected machine.

Mass credential theft and worm-like spread

GlassWorm doesn't just steal credentials; it also actively uses them to continue spreading . In documented incidents, operators have leveraged legitimate developer accounts—for example, on OpenVSX or GitHub—to upload corrupted versions of extensions or to push malicious commits to open-source projects.

In one case, a developer's account with several popular extensions was compromised and used to distribute malicious updates that included the GlassWorm payload. These extensions had been completely harmless for years, which reinforced users' confidence in updating without hesitation.

The commits used to introduce the malicious code were convincing: they included style changes, minor fixes, and commit messages consistent with the project's history . Everything suggests that the attacker used AI-assisted code generation tools, or even automatically generated commit templates, to ensure each modification matched the style of the compromised repository.

As this worm spreads, victims have been documented in multiple regions, including high-profile organizations . Among the data stolen from one of the command and control servers was a partial list of victims from the Americas, Europe, Asia, and even a Middle Eastern government entity. Alongside this information, traces of the operator were also found: keylogger data, indications of Russian language, use of C2 frameworks such as RedExt, and accounts on cryptocurrency exchanges and messaging platforms.

All of this points to a highly professional actor, with a clear financial motivation and a considerable capacity for technical iteration . Furthermore, it offers a clue as to why the campaigns remain active even after public reports and mitigation efforts: as long as the business model is profitable and the infrastructure isn't completely dismantled, the attacks will continue.

BlackMamba and the threat of AI-generated malware

Alongside the GlassWorm case, proof-of-concept projects have been developed exploring how language models and generative AI can shape a new type of malware . One of the best-known is BlackMamba, designed to demonstrate the potential of large language models in creating polymorphic keyloggers on demand.

BlackMamba starts with a benign executable that, at runtime, makes requests to a high-reputation API (such as OpenAI's) to request Python code capable of recording keystrokes. This code is dynamically generated on each execution, so it is never exactly the same, and is executed in memory using the function exec() from Python, without needing to write the payload to disk.

This makes the truly malicious part of the program polymorphic and fileless , as it resides only in memory and changes continuously. In tests conducted against commercial EDR solutions, this approach went completely undetected, generating no alerts or detections, even though the behavior (keylogging and data exfiltration) was clearly harmful.

To extract data from the infected device, the proof of concept used a channel many would consider innocuous: Microsoft Teams, via webhooks to a channel controlled by the attacker . In this way, usernames, passwords, credit card numbers, and any typed text could be sent through a legitimate corporate communications platform, blending in with the rest of the traffic.

The final packaging of the malware was carried out using tools like auto-py-to-exe, which allow Python scripts to be converted into standalone executables for Windows, macOS, or Linux. This way, the target user receives a file they can run without needing to have Python installed, facilitating its distribution through traditional techniques such as phishing emails, links in chats, or classic social engineering.

How far does the risk of AI-generated malware extend?

The existence of Proofs of Concepts like BlackMamba doesn't mean the world is suddenly defenseless, but it does make it clear that attackers can rely on AI models to combine malicious behaviors in unusual ways , exploiting gaps in detection systems based on historical patterns.

AI allows, for example, the generation of almost infinite variations of the same payload , the adjustment of code to evade specific heuristics, or even the production of commits with seemingly reasonable messages and changes to mask intrusion activities in code repositories. Combined with "reputable" exfiltration channels—such as Teams, public cloud services, or APIs from trusted providers—the line between legitimate and malicious traffic becomes even more blurred.

However, it's also true that the use of memory as the sole residence of malware, polymorphism, and the abuse of legitimate channels are challenges the cybersecurity industry has been facing for some time. The qualitative leap of AI isn't so much the emergence of entirely new techniques, but rather the ease with which any attacker can automate and orchestrate these techniques on a large scale.

Modern security solutions, especially those combining EDR/XDR with proprietary AI models and behavioral analysis , already work by monitoring execution patterns, access to sensitive APIs, network anomalies, and temporal correlations between events, rather than relying solely on static signatures. Even so, the pressure on defensive systems is increasing, and organizations that haven't yet adopted this approach face a greater risk from threats like those exemplified by BlackMamba.

In this scenario, it becomes clear that human intelligence remains crucial : analysts capable of interpreting subtle signals, understanding the context of an incident, and creatively adjusting defenses. Collaboration among security vendors, researchers, customers, and law enforcement becomes indispensable for sharing indicators of compromise (IOCs), attack patterns, and best response practices.

Supply chain defense: beyond traditional antivirus

All of the above points to one clear conclusion: organizations can no longer rely solely on visual code reviews, traditional antivirus software, or static package scans to protect their software supply chain. When malicious code can be literally invisible in the editor, run only in memory, or arrive encrypted and delayed, a comprehensive approach is essential.

Several specialized platforms have begun incorporating specific detection engines for patterns such as the use of invisible Unicode characters, encrypted payloads, and anomalous behavior in extensions and packages . These engines analyze both repositories and the artifacts that teams install (extensions, dependencies, container images, etc.), looking for suspicious instruction sequences, unusual API calls, and obfuscation patterns.

Another line of defense is the use of tools that wrap package managers (npm, npx, yarn, pnpm, and similar) with additional layers of security, intercepting potentially dangerous installations and comparing them against malware databases and risk models. Some solutions even combine AI with human analysts to quickly validate suspicious packages, blocking their entry into development environments.

For development teams, maintaining good credential hygiene is also critical: rotating tokens, using multi-factor authentication, limiting access scope , and monitoring for unusual changes in repositories and extensions associated with their accounts. If an attacker manages to impersonate a trusted maintainer, the impact on the entire user community of that package or extension can be enormous.

Ultimately, protecting against campaigns like GlassWorm or AI-generated polymorphic malware requires combining advanced technical controls, mature dependency management processes, and a healthy culture of distrust toward any component that hasn't been thoroughly verified. It's not about abandoning third-party software, but about assuming that any link in the chain can be an attack vector and acting accordingly.

The new malware emerging—from invisible worms in VS Code extensions to polymorphic keyloggers served by language models—demonstrates that attackers are becoming as sophisticated as the very technology we use to defend ourselves . Anyone wanting to keep pace will have to embrace behavior-based solutions, strengthen supply chain security, and, above all, stop assuming that what isn't visible in the editor or on the desktop doesn't exist.