GlassWorm Malware Uses Solana Dead Drops to Deliver RAT and Steal Browser, Crypto Data

GlassWorm is an advanced malware campaign that delivers a multi-stage data theft framework and RAT through poisoned packages on npm, PyPI, GitHub, and Open VSX.

• •Uses Solana blockchain memos and Google Calendar event URLs as dead drop resolvers to hide C2 server addresses
• •Stage two payload harvests credentials, cryptocurrency wallets, and system info, exfiltrating data as a ZIP archive
• •A .NET binary detects Ledger/Trezor USB connections and displays fake phishing UIs to steal 24-word wallet recovery phrases
• •A WebSocket-based JavaScript RAT supports HVNC remote desktop, SOCKS proxy, browser data theft, and Chrome app-bound encryption bypass
• •Force-installs a fake "Google Docs Offline" Chrome extension that steals cookies, keystrokes, DOM trees, and monitors Bybit sessions