GlassWorm Malware Uses Solana Blockchain to Deliver RAT and Steal Crypto Data

Cybersecurity researchers have identified a new evolution of the GlassWorm malware campaign that uses the Solana blockchain as a dead drop mechanism to deliver a sophisticated remote access trojan (RAT). The malware deploys a multi-stage framework capable of comprehensive data theft and installs a malicious Google Chrome extension that masquerades as an offline version of Google Docs. The malware demonstrates advanced capabilities including keystroke logging, cookie and session token dumping, screenshot capture, and targeted cryptocurrency data theft. The use of blockchain technology as a command and control mechanism represents a notable evolution in malware distribution tactics, potentially making detection and disruption more challenging for security teams. The attack specifically targets browser data and cryptocurrency-related information, suggesting the campaign is financially motivated. The Chrome extension component allows the malware to operate within the browser environment where users typically access sensitive financial and cryptocurrency services, maximizing the potential for data theft. Security researchers are analyzing the malware's infrastructure and attack patterns to develop detection signatures and mitigation strategies. Organizations and individuals are advised to maintain updated browser security, exercise caution with browser extensions, and monitor for suspicious network activity related to blockchain communications.

GlassWorm Malware Uses Solana Blockchain to Deliver RAT and Steal Crypto Data

// Source Consensus

// Key Events

// Entities

// Source Verification

// Takes & Comments

// Takes & Comments