GlassWorm Goes Mac: Fresh Infrastructure, New Tricks

Summary

The threat actor behind GlassWorm has pivoted from Windows-focused activity to macOS, distributing malicious VS Code extensions that fetch encrypted JavaScript payloads through Solana blockchain–derived C2 pointers. This wave expands capability by adding hardware wallet trojanization while continuing broad credential theft across browsers, developer tooling, and the macOS Keychain. The infrastructure includes a Solana wallet address and an IP reused from earlier GlassWorm operations, suggesting continuity in operator tooling and hosting. Researchers observed 50,000+ downloads before the extensions were removed, indicating meaningful exposure across developer environments.

Investigation

Koi Security identified three malicious VS Code extensions on the Open VSX marketplace and linked their command-and-control workflow to a Solana wallet plus a shared IP address previously tied to GlassWorm. The implants incorporate a 15-minute execution delay, then decrypt and run an AES-256-CBC JavaScript payload. On macOS, persistence is established via LaunchAgents. Collection targets include browser wallets and desktop wallet data, developer access tokens, SSH keys, and macOS Keychain material. The malware stages stolen data under /tmp/ijewf/ before exfiltration to a server path resembling /p2p. It also attempts to replace legitimate hardware wallet companion apps—such as Ledger Live and Trezor Suite—with trojanized lookalikes to capture high-value secrets and transactions.

Mitigation

Tighten controls around developer tooling by enforcing extension allowlisting and requiring security review for VS Code extensions, particularly those sourced from open marketplaces. Deploy runtime detections for delayed execution patterns and suspicious creation or modification of LaunchAgents. Monitor and block suspicious outbound activity associated with Solana-derived C2 lookups, and add network detections for unusual connections to the identified reused IP. Require MFA for developer and cloud accounts and implement hardware wallet integrity checks (publisher validation, notarization/signature verification, and controlled software update channels).

Response

Trigger alerts on new or modified LaunchAgents, anomalous access to Keychain stores, and retrieval attempts from Solana-referenced C2 endpoints. Quarantine and remove the malicious VS Code extensions, then eradicate any associated LaunchAgent persistence. Perform targeted forensics on /tmp/ijewf/ to scope credential staging and confirm what data was collected. Validate the integrity of hardware wallet applications (Ledger Live, Trezor Suite) and re-install from trusted sources if tampering is suspected. Reset impacted credentials, rotate SSH keys and developer tokens, invalidate sessions, and expand hunting across endpoints for the same extension IDs, file paths, and persistence artifacts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  An attacker who has already compromised a low‑privileged macOS user account wishes to harvest a service account password stored in the Keychain under the label pass_users_for_script. To avoid dropping a separate binary, the attacker writes a one‑liner AppleScript that invokes the built‑in security tool via do shell script. The script is executed directly in the user’s session, producing a process creation event with the exact command line the Sigma rule matches.

  # Create a test keychain item (only for demonstration; real attacker would target existing item)
  security add-generic-password -a attacker -s pass_users_for_script -w SuperSecret123
  
  # Execute the AppleScript that reads the password
  osascript -e 'do shell script "security find-generic-password -s '''pass_users_for_script''' -w"'

• Regression Test Script:

  #!/usr/bin/env bash
  set -euo pipefail
  
  # Step 1: Ensure the target keychain entry exists (idempotent)
  if ! security find-generic-password -s pass_users_for_script -w >/dev/null 2>&1; then
      security add-generic-password -a attacker -s pass_users_for_script -w SuperSecret123
  fi
  
  # Step 2: Execute the AppleScript that triggers the detection rule
  echo "[+] Executing AppleScript to read the keychain entry..."
  osascript -e 'do shell script "security find-generic-password -s '''pass_users_for_script''' -w"'

• Cleanup Commands:

  # Remove the test keychain item to leave the system clean
  security delete-generic-password -s pass_users_for_script
  echo "[+] Cleanup complete: test keychain entry removed."