GlassWorm Hides a RAT Inside a Malicious Chrome Extension

Summary

GlassWorm abuses compromised npm, PyPI, GitHub, and OpenVSX packages to distribute a multi-stage malware platform. Its first stage launches a loader that queries a Solana blockchain memo to obtain command-and-control addresses, then downloads an encrypted payload. The second stage steals credentials, cryptocurrency wallet files, and host details, while the third stage deploys a persistent WebSocket-based RAT along with a malicious Chrome extension designed to capture browser data. The operation is aimed primarily at developers and cryptocurrency holders.

Investigation

Analysts linked the initial compromise to malicious pre-install scripts and Unicode-based loaders embedded in otherwise legitimate packages. They uncovered two Solana wallet addresses acting as dead-drop locations for C2 URLs and saw the loader polling several Solana RPC endpoints. The stage-three RAT relies on DHT bootstrap nodes and reverts to Solana-based retrieval if DHT resolution fails. Researchers also identified the exfiltration infrastructure and mapped the malicious Chrome extension used in the campaign.

Mitigation

Organizations should enforce supply-chain scanning for npm and other package ecosystems, verify package integrity and publisher trust, and block known malicious IPs and domains. Endpoint defenses should monitor for rogue Node.js runtimes, unexpected scheduled tasks, and suspicious registry Run keys. Browser credential stores should be hardened, and cryptocurrency users should adopt hardware wallet verification where possible.

Response

If GlassWorm is detected, isolate the affected endpoint, stop the malicious processes, and remove any dropped files and persistence mechanisms such as scheduled tasks. Revoke compromised npm tokens, rotate cryptocurrency wallet credentials, and reset browser-stored passwords. Complete a full forensic review of host logs to trace loader execution and update security controls to reduce the risk of future supply-chain compromises.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker has obtained a malicious binary that pretends to be the Ledger Live/Trezor wallet client. The binary is named Assaac.exe to mimic a legitimate executable. It is dropped into the user’s %APPDATA% directory, and a companion JavaScript file (index.js) is placed in a hidden sub‑folder QtCvyfVWKH. The attacker then executes the binary, causing Windows to log a process‑creation event with the exact image name and command‑line path that the Sigma rule watches.

  Step‑by‑step:

  1. Create the hidden folder and drop the malicious script.
  2. Copy the malicious executable (Assaac.exe) into the user’s AppData.
  3. Launch the executable, which reads index.js and begins credential‑theft routines.

• Regression Test Script:

  # ------------------------------------------------------------
  # Setup malicious files
  # ------------------------------------------------------------
  $appData = $env:APPDATA
  $folder  = Join-Path $appData "QtCvyfVWKH"
  $exePath = Join-Path $appData "Assaac.exe"
  $jsPath  = Join-Path $folder "index.js"
  
  # Ensure the hidden folder exists
  New-Item -ItemType Directory -Path $folder -Force | Out-Null
  # Hide the folder (optional)
  (Get-Item $folder).Attributes += 'Hidden'
  
  # Deploy a dummy malicious executable (for demo we use a copy of calc.exe)
  Copy-Item -Path "$env:SystemRootSystem32calc.exe" -Destination $exePath -Force
  
  # Deploy a dummy JavaScript payload (content is irrelevant for detection)
  @"
  // malicious payload placeholder
  console.log('Crypto wallet theft executed');
  "@ | Set-Content -Path $jsPath -Encoding UTF8
  
  # ------------------------------------------------------------
  # Execute the malicious binary (this should fire the Sigma rule)
  # ------------------------------------------------------------
  & $exePath "$jsPath"
  
  # ------------------------------------------------------------
  # End of script – leave artifacts for manual cleanup
  # ------------------------------------------------------------

• Cleanup Commands:

  # Terminate the malicious process if still running
  Get-Process -Name "Assaac" -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # Remove the created files and folder
  Remove-Item -Path $exePath -Force -ErrorAction SilentlyContinue
  Remove-Item -Path $jsPath -Force -ErrorAction SilentlyContinue
  Remove-Item -Path $folder -Recurse -Force -ErrorAction SilentlyContinue