CrowdStrike has partnered with Google to take down a Glassworm botnet that targeted developers.
Security firm CrowdStrike, together with Google and the Shadowserver Foundation, has dismantled the Glassworm botnet. The malware had been spreading since early 2025 via infected software packages and specifically targeted developers.
According to CrowdStrike, all four of the botnet’s channels were disabled simultaneously on Tuesday. This caused the attackers to lose control over infected systems and prevented them from spreading any further malware.
Worm spread via software
Glassworm was first discovered in October 2025 and stood out due to its advanced distribution methods. The malware infected Visual Studio Code extensions on OpenVSX, and npm and Python packages were also compromised.
Using stolen login credentials, Glassworm was able to compromise more than 300 GitHub repositories. The worm operated on Windows, macOS, and Linux, and also installed its own remote access tool called GlasswormRAT.
The malware stole passwords, API keys, and other sensitive data. Furthermore, infected systems could be used as proxy servers for criminal activities.
Blockchain and Google Calendar
Glassworm used command servers that were partially hidden via the Solana blockchain, and Google Calendar was used as a location for encrypted instructions.
Additionally, the malware utilized a decentralized BitTorrent Distributed Hash Table (DHT) network and traditional VPS servers to distribute extra malware. According to CrowdStrike, the entire infrastructure had to be disabled at once to prevent the attackers from quickly becoming operational again. All systems still infected with Glassworm now automatically connect to a harmless IP address managed by CrowdStrike. Companies are advised to check network and endpoint logs for connections to this address.