Griffin's Badass Computers Inc.

🚨Send Email!

GlassWorm is back. For the THIRD time. 😱 First wave in October. Second wave in November. And now? 24 new malicious extensions just dropped on December 1st. This self-spreading worm targets VS Code extensions. Here's what makes this terrifying. The malware is literally invisible. Not obfuscated. Not hidden in minified files. Actually invisible to the human eye. The attackers use Unicode characters that don't render in code editors. You could review the code and see nothing wrong. What does GlassWorm steal? → Your GitHub credentials → Your npm tokens → Your OpenVSX account → Your Git credentials → Data from 49 cryptocurrency wallet extensions But it gets worse. Once infected, your machine becomes part of their criminal network. They install a SOCKS proxy to route malicious traffic through your computer. They install hidden VNC for complete remote access. And the stolen credentials? They use them to infect MORE extensions. That's why it's called a worm. It spreads itself. The third wave impersonates popular developer tools: → Flutter extensions → React Native extensions → Vue extensions → Tailwind extensions → Vim extensions → Yaml extensions → Svelte extensions → Prettier clones The attackers publish the extension, wait for approval, then push an update with the malware. They inflate download counts to appear legitimate. The fake extension shows up right next to the real one in search results. One click. That's all it takes. VS Code extensions auto-update. When a compromised extension pushes a malicious update, everyone who installed it gets infected automatically. No user interaction. No warning. Silent infection. Why can't they stop it? GlassWorm uses the Solana blockchain for command and control. You can't take down a blockchain. Google Calendar serves as backup. The infrastructure is basically unkillable. What should you do? → Audit your installed VS Code extensions right now → Check for suspicious extensions you don't remember installing → Remove extensions you don't actively use → Don't auto-update extensions blindly → Verify publisher reputation before installing anything new Each installed extension extends your attack surface. Supply chain attacks are exploding. Your code editor is now an attack vector. Want to understand how attackers think? I cover exploitation techniques and the hacker mindset in my ethical hacking course. → https://www.udemy.com/.../ethical-hacking-complete.../... (The link supports me directly as your instructor!) Your development environment is only as secure as your extensions. Check yours. Now. 🎯 #EthicalHacking #GlassWorm #VSCode #SupplyChainAttack #CyberSecurity #InfoSec #DeveloperSecurity #Malware Research & writing: Jolanda de Koff | HackingPassion.com Sharing is fine. Copying without credit is not." PyStoreRAT. A new RAT discovered by Morphisec. And the attack is brilliant. 😏 Hackers are targeting developers, security researchers, and IT professionals. With fake tools. On GitHub. They're not creating obvious malware repos. They're building tools that look exactly like what we search for. OSINT utilities. GPT wrappers. DeFi bots. Security scanners. Professional README files. Clean code. Working demos. Some of these repos even reached GitHub's trending lists. And that's when the trap closes. The attackers use old, inactive GitHub accounts. Accounts that sat dormant for years suddenly wake up and start publishing. Why? Because GitHub's algorithm trusts older accounts more than new ones. A repo from an account created in 2019 looks more legitimate than one from last week. After a repo gains traction and stars, they push a "maintenance" commit. Just a few lines of Python or JavaScript. Nothing suspicious at first glance. But those lines download a remote HTA file and execute it through mshta.exe. No traditional .exe file touches your disk during initial infection. Once running, PyStoreRAT profiles your entire system. It checks for security products like CrowdStrike Falcon and CyberReason. If detected, it changes its execution method to avoid triggering alerts. It creates a scheduled task disguised as "NVIDIA App SelfUpdate" that runs every 10 minutes. What are they after? Cryptocurrency wallets. PyStoreRAT specifically scans for Ledger Live, Trezor, Exodus, Atomic, Guarda, and BitBox02. It also deploys Rhadamanthys, a known info stealer that grabs browser passwords, cookies, and saved credentials. The malware even spreads through USB drives. Connect a drive, and it replaces your documents with malicious shortcut files. Click what looks like your file, and you're running the malware first. Here are some of the malicious repository names identified: → spyder-osint (multiple variants) → HacxGPT → KawaiiGPT → openfi-bot → VulnWatchDog → crypto-tax-calculator Most have been removed by GitHub. Some are still live. I build OSINT tools on GitHub myself. Shodan Eye, Dorks Eye, Ghost Eye. This attack exploits the trust that open source developers have built over the years. How to protect yourself: → Check account history before cloning (years dormant, then sudden activity = red flag) → Read the actual code, not just the README → Watch for recent commits that add network calls or file downloads → Test unknown tools in a VM, always Quick check for infection: Open Task Scheduler and look for "NVIDIA App SelfUpdate" that doesn't point to actual NVIDIA software. Check C:\ProgramData\ for suspicious folders. If you find something, isolate that machine immediately. Good news for Linux users: PyStoreRAT's attack chain is Windows-specific. But that doesn't mean malicious GitHub repos can't contain Linux payloads. Always stay alert. The open source security community runs on trust. Don't stop downloading tools. Just verify before you run. Want to understand malware analysis, social engineering, and how attackers think? I cover these topics in my ethical hacking course: → https://www.udemy.com/.../ethical-hacking-complete.../... (The link supports me directly as your instructor!) Hacking is not a hobby but a way of life. 🎯 #EthicalHacking #GitHub #PyStoreRAT #SupplyChainAttack #CyberSecurity #OSINT #Malware #InfoSec #OpenSource Research & writing: Jolanda de Koff | HackingPassion.com Sharing is fine. Copying without credit is not.