Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.
Not cited by any technique.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1008 Fallback Channels |
MalwareGlassWorm | GlassWorm has utilized Google Calendar as backup C2. |
| T1027.013 Encrypted/Encoded File |
MalwareGlassWorm | GlassWorm has leveraged AES-256-CBC encryption to obfuscate its malicious JavaScript payload. GlassWorm has also utilized Base64 encoding to obfuscate the C2 details stored in the Solana memo field. |
| T1027.018 Invisible Unicode |
MalwareGlassWorm | GlassWorm has utilized invisible Unicode Private Use Area (PUA) characters to obfuscate its malicious code so that it does not render in code editors. |
| T1059.007 JavaScript |
MalwareGlassWorm | GlassWorm has leveraged JavaScript to execute its malicious code to include its hidden Unicode characters using the `eval` call. GlassWorm has also utilized encrypted payloads compiled in JavaScript. |
| T1071.001 Web Protocols |
MalwareGlassWorm | GlassWorm has used HTTP for C2 and extracts data from the HTTP response headers. |
| T1090.001 Internal Proxy |
MalwareGlassWorm | GlassWorm has leveraged peer-to-peer software to facilitate communications within the victim network to include the software WebRTC. GlassWorm has also established a SOCKS proxy to interact with victim devices that also acted as a proxy node for follow-on behaviors. |
| T1102.001 Dead Drop Resolver |
MalwareGlassWorm | GlassWorm has leveraged blockchain-based C2 infrastructure to include Solana blockchain that contains additional C2 details within the memo field. GlassWorm has also leveraged Google Calendar to host encoded data. |
| T1140 Deobfuscate/Decode Files or Information |
MalwareGlassWorm | GlassWorm has decoded its Base64 instructions. GlassWorm has also decrypted its AES protected payloads. |
| T1195.001 Compromise Software Dependencies and Development Tools |
MalwareGlassWorm | GlassWorm has spread through Visual Studio extensions. GlassWorm has also spread through JavaScript projects hosted on Github. |
| T1213.003 Code Repositories |
MalwareGlassWorm | GlassWorm has gathered code repository authentication materials for NPM and GitHub. GlassWorm has collected details pertaining to the npm configuration data for `_authToken`. |
| T1547.001 Registry Run Keys / Startup Folder |
MalwareGlassWorm | GlassWorm has set registry run keys for persistence in both `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\Software\Microsoft\Windows\CurrentVersion\Run\`. |
| T1564.003 Hidden Window |
MalwareGlassWorm | GlassWorm has leveraged Hidden Virtual Network Computing (HVNC) to remain undetected and conduct execution of collection and communication actions. |
| T1571 Non-Standard Port |
MalwareGlassWorm | GlassWorm has distributed C2 using BitTorrent’s Distributed Hash Table (DHT) network to harness a decentralized command capability. |
| T1657 Financial Theft |
MalwareGlassWorm | GlassWorm has the ability to steal credentials for cryptocurrency wallets. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
