Gate News reports that the security agency GoPlus has issued a warning indicating that GlassWorm has evolved from an early VS Code worm into a highly sophisticated supply chain attack framework that disguises itself as a Chrome extension to steal users’ sensitive data and cryptocurrency assets, with the threat scope continuously expanding.
The core of this attack relies on poisoning and covert code injection. Attackers manipulate npm and PyPI packages using special Unicode and PUA characters, embedding malicious loaders. These characters are difficult to identify in code review tools, allowing the malicious code to bypass traditional static analysis detection, contaminating the development environment from the source.
On the communication front, GlassWorm employs a more covert control method. It abandons traditional domain name servers and instead uses the Solana blockchain as a command and control channel, hiding instructions within on-chain transaction notes. This design enhances the attack infrastructure’s resistance to blocking, making it challenging to trace or cut off using conventional means.
At the endpoint, the attack is executed by disguising itself as a “Google Docs Offline” extension. This malicious plugin can steal browser cookies, clipboard content, and browsing history, while also possessing keystroke logging and screenshot capabilities, and can monitor activities on hardware wallets like Ledger and Trezor. Moreover, attackers may pop up phishing interfaces to lure users into entering their recovery phrases, thereby gaining direct control over digital assets.
GoPlus advises users to deploy detection tools capable of identifying hidden characters and to avoid installing software or plugins from unknown sources. Additionally, be vigilant about unusual transaction signatures and transfer requests. If a device is suspected of being compromised, disconnect it from the network immediately and change all related account credentials to minimize potential losses.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Luck.io, Solana's Non-Custodial Casino, Shuts Down; Users Urged to Withdraw Funds Immediately
Gate News message, April 24 — Luck.io, a non-custodial casino platform built on Solana, announced its closure on April 24, 2026, urging all users to withdraw their balances from Smart Vaults immediately. Withdrawals can be initiated through the luck.io website or via the Vault Withdrawal Tool at
GateNews1h ago
XRP Expands to Solana as wXRP Drives DeFi Access
Key Insights
Wrapped XRP on Solana surpasses 834,000 tokens, enabling new DeFi access while strengthening cross-chain liquidity and expanding XRP utility beyond its native ledger.
Ethereum and Solana dominate DeFi activity, while XRP Ledger trails significantly, driving the need for
CryptoNewsLand1h ago
XRP Expands to Solana as wXRP Drives DeFi Access
Key Insights
Wrapped XRP on Solana surpasses 834,000 tokens, enabling new DeFi access while strengthening cross-chain liquidity and expanding XRP utility beyond its native ledger.
Ethereum and Solana dominate DeFi activity, while XRP Ledger trails significantly, driving the need for
CryptoNewsLand1h ago
Circle Mints 500M USDC on Solana in Two Transactions
Gate News message, April 24 — Circle, the stablecoin issuer, just minted 500 million USDC on the Solana blockchain, according to on-chain data.
The minting was completed in two separate transactions, each involving 250 million USDC.
GateNews3h ago
GSR Debuts BESO ETF With Bitcoin, Ethereum, Solana
GSR debuts BESO ETF with active strategy, adjusting Bitcoin, Ether, and Solana allocations weekly to outperform benchmarks.
ETF records nearly $5M in first-day volume, signaling early investor interest in diversified crypto investment products.
Launch aligns with growing ETF momentum as
CryptoFrontNews5h ago
OSL Group Partners with Circle to Expand USDC Access Across Trading and Payment Platforms
Gate News message, April 24 — OSL Group (HKEX: 863), a global stablecoin payment and trading platform, announced a partnership with an affiliate of Circle Internet Group, Inc. (NYSE: CRCL) on April 22 to expand USDC access across its payment and trading platforms.
Through OSL Global, users can conv
GateNews7h ago
