DanSec

Threat actor

GlassWorm

In 18 briefs, most recently 22 October 2026. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

  1. Railway secrets exposure, Onamae VPS malware on 26,739 servers, LiteLLM supply chain attack, and critical PHP2Shell RCE flaws under mass exploitation.
  2. Lazarus Group's FlashHole watering-hole campaign, Tor exit relay hijacking, and Zeabur's second breach in two months.
  3. GlassWorm botnet takedown, FBI warning on Silent Ransom Group in-person law firm attacks, and Iranian link to LA Metro cyberattack.
  4. The CPUID supply chain attack, Hims health data breach, Storm-2755 payroll hijacking, and Juniper Junos OS critical flaw patches.
  5. The Hightower Holding breach (130,000 affected), the TeamPCP supply chain attack added to CISA KEV, and Langflow exploitation (CVE-2026-33017).
  6. LeakBase admin arrest, HackerOne employee data breach via Navia, and Microsoft 365 device code phishing hitting 340+ organizations.
  7. The Intuitive phishing breach, GlassWorm supply-chain malware hitting 400+ repos, and Sears exposing AI chatbot conversations to the public web.
  8. The Stryker Microsoft environment wiper attack, GlassWorm hitting Python repos, and Vidar delivered via hacked WordPress sites.
  9. AppsFlyer Web SDK supply-chain hijack stealing crypto, GlassWorm abusing 72 Open VSX extensions, and OpenClaw AI agent flaws.
  10. Notepad++ supply chain attack, ShinyHunters' Panera Bread leak of 5.1M records, and actively exploited SolarWinds Web Help Desk RCE added to CISA KEV.
  11. Lotus Blossom hijacks Notepad++ update channel, Panera Bread breach exposes 5.1M accounts, and 341 malicious OpenClaw AI skills found.
  12. Supply chain attacks hit eScan antivirus updates and Open VSX Registry (GlassWorm), plus automated MongoDB data extortion campaigns.
  13. RondoDox botnet exploits React2Shell to hijack IoT devices; GlassWorm pushes trojanized crypto wallets to macOS developers via malicious VSCode extensions.
  14. Coupang breach exposing 33.7M users, Shai-Hulud 2.0 npm attack leaking 400,000 developer secrets, and North Korean threat actors renting engineers' identities …
  15. Coupang breach exposing 33.7M customers, CodeRED alert platform shut down by Inc ransomware, and SmartTube app compromised via stolen signing keys.
  16. Oracle EBS Cl0p extortion hits nearly 30 firms incl. Logitech and Washington Post; CBO confirms breach; Konni abuses Google Find Hub.
  17. GlassWorm returns with malicious VS Code extensions on OpenVSX; Microsoft discloses Whisper Leak AI side-channel attack and reminds Windows 10 users to enroll …
  18. F5 breach, Muji ransomware outage via Askul, AWS two-hour outage, and Salt Typhoon's Snappybee attack on a European telecom, plus GlassWorm and WatchGuard …