GoPlus Security 🚦 (@GoPlusSecurity): 🚨 GoPlus Security Alert:

🚨 GoPlus Security Alert: GlassWorm Evolves from a VS Code Worm into an Advanced Supply Chain Attack Framework GlassWorm has evolved into a sophisticated supply chain attack, deploying a malicious Chrome extension disguised as “Google Docs Offline” to steal sensitive data and digital assets. 🦠 Attack Mechanism: 1. Dependency poisoning + invisible code injection Attackers poison npm/PyPI packages and inject malicious loaders using specially crafted Unicode and PUA characters. These characters are invisible in code review tools and diff views, allowing them to bypass conventional static analysis. 2. Blockchain-based C2 channel GlassWorm abandons traditional domains and leverages the Solana blockchain as its command-and-control (C2) channel. Instructions are hidden in transaction memos, making the infrastructure resilient and difficult to disrupt via IP blocking. 3. Malicious extension deployment Silently installs a fake “Google Docs Offline” extension to: • Steal cookies, clipboard data, and browsing history • Log keystrokes and capture screenshots • Monitor hardware wallets (e.g. Ledger, Trezor) • Display phishing popups to trick users into revealing seed phrases 🛡️ #GoPlus Security Tips 1. Integrate detection tools for invisible Unicode/PUA characters 2. Follow the #GoPlus Anti-Phishing “4 Don’ts”: Don’t click unknown links, don’t install untrusted software, don’t sign suspicious transactions, don’t transfer funds to unverified addresses 3. If infected, disconnect from the network immediately and rotate all exposed credentials and tokens 🔗 More details: https://aikido.dev/blog/glassworm-chrome-extension-rat