GlassWorm Malware Uses Solana Dead Drops to Deliver RAT and Steal Browser, Crypto Data

Researchers uncovered a sophisticated GlassWorm supply-chain campaign that pushes poisoned packages across npm, PyPI, GitHub and Open VSX to deploy a multi-stage data-theft framework and RAT; components include a .NET hardware-wallet phishing module, a WebSocket/JavaScript RAT that force-installs a malicious Google Docs Offline Chrome extension to harvest cookies, DOM, keystrokes and more, and use Solana transactions and DHT as dead-drop C2 resolvers, with multiple external IPs and endpoints observed for exfiltration.