Malware

GlassWorm

According to Koi Security, this malware harvests NPM, GitHub, and Git credentials for supply chain propagation. It targets 49 different cryptocurrency wallet extensions to drain funds. It uses stolen credentials to compromise additional packages and extensions, spreading the worm further. Furthermore, it deploys SOCKS proxy servers, turning developer machines into criminal infrastructure and installs hidden VNC servers for complete remote access.

Indicators of Compromise 9

Domain moonsand[[.]]store Filename Apple Sync Filename HDUtil.exe Filename go.bat Filename hwid.dat Filename protobuf.dll Filename termsrv.dll GitHub Repo SQL Server Management Studio Package Rilide

MITRE ATT&CK TTPs 17

OS Credential Dumping

Credential Access

Remote Desktop Protocol

Lateral Movement

Obfuscated Files or Information

Defense Evasion

Process Injection

Defense Evasion

Exploitation for Privilege Escalation

Privilege Escalation

Defense Evasion

Default Accounts

Defense Evasion

System Information Discovery

Command And Control

Ingress Tool Transfer

Command And Control

Defense Evasion

Bypass User Account Control

Privilege Escalation

Adversary-in-the-Middle

Credential Access

Source Articles

OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps

OkoBot is a malware framework targeting Windows users, active since April 2025, that injects phishing pages into legitimate cryptocurrency wallet applications like Ledger Live and Trezor Suite to steal recovery phrases. One of its modules, SeedHunter, hooks into Electron-based apps and waits for hardware wallet connections before displaying a malicious recovery page. The framework uses trojanized software and phishing lures to gain access, establishes persistent remote access via SSH and RDP, and deploys multiple surveillance and data-stealing plugins. Kaspersky attributes the campaign to an unknown actor but notes Russian-language artifacts and targeting patterns.

hacker-news ·1w ago