CrowdStrike, Google Take Down Glassworm Botnet
2026-05-27T14:52:14Z•28f584bd04ded05a721c9045f212e8fdf6e5994895c129d1a72e93192654f6df
android-ratbotnet-takedownbtmobcrowdstrikeexchange-zero-dayfifa-phishing-domains','law-enforcement-takedown','europol','fbigithub-breachglasswormgooglegrafanagremlin-stealerinfostealerkali365linux-ptracemini-shai-huludnpm-wormnx-consoleoauth-token-theftphishingpurelogsseo-poisoningsoftware-developer-targetingsupply-chain-attacktanstackvs-code-extension
What happened
A broad set of high-impact security stories: CrowdStrike and Google dismantled the Glassworm botnet that has been targeting software developers since early 2025; multiple supply‑chain and developer-focused attacks surfaced (malicious VS Code/Nx Console extension tied to GitHub breaches, TanStack/Grafana code theft, and the Mini Shai‑Hulud npm worm). Active campaigns include large-scale phishing, SEO‑poisoning and infostealer distribution (fake FIFA/Gemini/Claude sites, Kali365 OAuth token theft), PureLogs and Gremlin data‑theft operations, BTMOB Android RAT service, and hundreds of fake apps/‘
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- infosecurity_magazine
- Record identifier
- 28f584bd04ded05a721c9045f212e8fdf6e5994895c129d1a72e93192654f6df
- Enrichment time
- 2026-05-27T14:52:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.