GlassWorm Malware Campaign Steals Crypto Seeds via Obfuscation, Chrome Exploit, and Social Engineering: Mitigation Strategies

The GlassWorm malware campaign targets cryptocurrency wallet seed phrases using a three-pronged attack: xorshift-based runtime obfuscation to evade detection, exploitation of an unpatched Chrome HMAC vulnerability for arbitrary code execution, and spear-phishing for initial delivery. Once installed, it intercepts seed phrases via keylogging or clipboard capture, then exfiltrates encrypted data to a C2 server disguised as normal traffic.