Full transcript
0:00Look, malware's invisible now, guys. I
0:01don't know what to tell you. I mean, I
0:03guess you can't really look cuz you
0:04can't see it cuz it's invisible now,
0:06right? You know what I mean? Glassworm
0:08returns with 24 malicious extensions
0:11impersonating popular developer tools.
0:14It's malware, a worm that you can't see.
0:17And that's why they call it Glassworm.
0:19This has been hitting the streets
0:20lately. A supply chain campaign called
0:23Glassworm has been running around since
0:25about October, last couple months. Right
0:28now, the worm is being spread by
0:30Microsoft Visual Studio extensions.
0:33They're all available on the real,
0:35legitimate, and official Microsoft
0:37Visual Studio Marketplace and OpenVSX.
0:40And it's impersonating a lot of
0:42programmer like software developer tools
0:44and frameworks. Things like Flutter,
0:45React, Tailwind, Vim, and Vue. And we've
0:48seen this around for a little bit. This
0:50was first called out in October, a
0:52couple months back. And it uses, this is
0:55bonkers, the Solana blockchain. A lot of
0:57cryptocurrency stuff actually using it
1:00for command and control. It then
1:02harvests NPM credentials, OpenVSX,
1:05GitHub, and Git credentials, and drains
1:07cryptocurrency from your wallet, and
1:09realistically infects your machine so
1:12that that's part of a little botnet to
1:14do more shady hacker cybercrime stuff.
1:17Now, what makes this malware really a
1:19worm, and like the craziest thing about
1:21this, is that once it compromises you,
1:23once you're infected, once it's stolen
1:25your credentials, your username,
1:27password, account token, session cookie,
1:29all this stuff, then it actually uses
1:31your account to compromise your packages
1:34or additional packages and infects those
1:36other extensions and makes this spread
1:39like a worm. Take a look at all of these
1:41original malicious extensions. There are
1:44a lot of these, 24 written up in this
1:47article here. But I want to chat
1:49specifically about Glassworm. Glassworm
1:53is interesting because, again, given
1:55that name, self-propagating malware,
1:58they've got a little bit of extra
2:01stealth here because the glass component
2:04is that it's using invisible Unicode
2:06characters that make the malicious code
2:09basically disappear. And I think it was
2:12Koi Security that gave it this Glassworm
2:15name. And I'll leave all the links in
2:17the video description for this. But let
2:19me say straight up, this isn't a new
2:21technique. This isn't a new trick. Using
2:24some invisible characters or Unicode
2:27tricks is well-known. It's essentially
2:29whitespace steganography. But this
2:32technique and using it in this sort of
2:34attack, this specific campaign, was new.
2:37It's a new threat. So I, for one, am
2:39interested. How are they doing this?
2:42What is the threat actor, this hacker,
2:43the cybercriminal doing to do this
2:47invisible Unicode trick? How are they
2:49performing that whitespace
2:51steganography? And Koi Security got to
2:54take a look at one of the payloads. They
2:55opened up one of these malicious
2:57extensions and tried to go see what they
3:00could do in the code. But they didn't
3:03see it because it wasn't there. Take a
3:06look at this. You see this visual space?
3:08Like all of this whitespace, that's not
3:10newline characters or just space
3:12characters or anything. That's code.
3:14That's malicious code that you can't
3:16see. And Koi does a good job chatting
3:18about this. Hey, see that massive gap
3:20between lines two and seven? It's not
3:22empty space. That is the malware. And I
3:25think this is kind of neat. I know
3:26they're saying, "Hey, look, the malware
3:28is invisible. It's not obfuscated. It's
3:30not hidden in some minified file. It's
3:32legitimately invisible to the human
3:34eye." So I know some of you capture the
3:36flag gurus or security veterans might
3:38kind of scoff and say like, "Well, hey,
3:39we've we've seen that before, right?
3:41It's it is whitespace steganography in
3:43the context of this invisible Unicode
3:46attack." But I think when you're
3:48thinking about this for a supply chain
3:50threat across Git or GitHub or text
3:52editors with big long text files, plain
3:55text source code that you might be
3:57working with as a developer, look, that
3:59could be tucked away in files that you
4:01never even look at. And I'm wondering,
4:03are they doing like, "Oh, classic Q T O
4:06spaces and tabs map to a zero or one?"
4:10But of course you think of Unicode
4:11characters, and maybe you think of the
4:13zero-width spaces. So again, I'm super
4:15curious, how is this working and what
4:18other threat actors are talking about
4:19this? Greater question, are other threat
4:22actors talking about this? So I went to
4:24go take a look on Flare, like a sort of
4:27Google search for the dark web, right?
4:28If I were to try and look for anyone
4:30talking about invisible Unicode. And I
4:33want to go toggle to see, hey, across
4:36all of maybe lookalike domains or leaked
4:38credentials or the open web for maybe
4:41source code on Git, maybe Pastebin,
4:42maybe AWS buckets. I'm more interested
4:45in those shady illicit networks. Like
4:47are there dark web forums or Telegram
4:49chats where folks are talking about
4:52this? I want to toggle all of these off,
4:54but I do want to make sure forum posts
4:56is on because I'm curious, is anyone
4:58talking about this? More often than not,
5:00I think I see folks sharing the news.
5:03Like they are just syndicating the
5:05headlines and articles that have already
5:07been shared on these other pages. But we
5:09could see potentially threat actors
5:11talking about this technique and if it's
5:14being used. Maybe some threat was the
5:17Tycoon 2FA group that's doing this for a
5:20lot of fishing endeavors. I actually
5:22want to expand this to see, can I track
5:24down the URL or where is this being
5:27shared on the dark web? So I'm firing up
5:29my Tor browser and I'm taking a look at
5:31this BFD forum. "Only for
5:35professionals," they say. Couple more of
5:37the advertisements loading there on the
5:40top of the page. And I don't know,
5:42again, you got to take this all with a
5:43grain of salt. But if they are just kind
5:45of syndicating some of the other stuff,
5:47can I search for, what was it, invisible
5:51Unicode? Search.
5:54It was a news header. Yeah, passwords
5:56authentication. This was it. Passwords
5:58authentication capture all in vain.
6:01Tycoon 2FA takes fishing to a new level
6:03of horror. Okay.
6:06But look, look, look, look, they are
6:07talking about the invisible Unicode
6:11characters here. One key innovation of
6:13Tycoon 2FA, even previously they were
6:16talking about in 2023, now they're
6:19discussing, "Hey, they're using the
6:20invisible Unicode characters to conceal
6:22binary data within JavaScript code." The
6:25technique, first described by Juniper
6:27Threat Labs in February of 2025. Okay,
6:30so I want to go see what they were
6:32tracking. Allows malicious scripts to be
6:34decrypted and executed at runtime all
6:37while remaining undetectable by both an
6:40automated scanner and manual code
6:42reviewers because you can't see it. Look
6:44at the picture there. I don't know how
6:45well you could see, but it just looks
6:46like whitespace. Now, before I go hunt
6:49down that Juniper Threat Labs report, I
6:50did want to give a little bit more love
6:52to Flare because look, you know I'm a
6:54fanboy. It's just the coolest thing. If
6:56you wanted to be able to track the
6:57security of your teammates, of yourself,
6:59your employees, your business, your
7:01whole organization, and whether or not
7:03they have their information exposed out
7:05on the dark web or even the clearnet, if
7:07their credentials are loose in the wild,
7:09if they were part of a data breach, if
7:11folks are talking about them on the dark
7:13web, you could create all these
7:14different identifiers for even your own
7:16tenant in Microsoft 365 or Entra ID. If
7:20and when their information is ever
7:22leaked, you could have alerts notify
7:23you, you could mitigate, you could
7:25automatically remediate, rotate
7:26credentials as needed. And of course,
7:28you can get different specific reports
7:30for your industry, for your sector,
7:32whatever you're up to, and make sure
7:34that you're not hit downstream by
7:36different ransomware events. Or if any
7:38of your team's credentials, passwords,
7:40cookies are found in info stealer
7:42malware logs, look, Flare is tracking
7:44like whatever, some absurd number, 14
7:47billion or something, an incredible
7:49amount of telemetry, insight, and
7:51understanding of what the dark web and
7:53that cybercrime ecosystem is so that you
7:55could stay ahead of it. Flare is super
7:57cool. They will save your bacon.
7:59Seriously, I hope you check them out.
8:00Link below in the video description.
8:02Thanks so much to Flare for sponsoring
8:03this video. All right. So going back in
8:05time to February of this year, from the
8:09Juniper Threat Labs, they say,
8:10"Invisible [clears throat] obfuscation
8:12technique used in PACK attack." So I
8:15wanted to dig into this. In early
8:17January 2025, they observed a JavaScript
8:20obfuscation technique that, ooh, was
8:23first described by a security researcher
8:25on X back in October 2024. Oh, I got to
8:29see that. Okay. Invisible.js,
8:33JavaScript payload to write hidden code.
8:36It uses hangful filler characters like
8:39the Unicode 3164
8:42in combination with JavaScript's with
8:44statement and a proxy object to encode
8:46and evaluate the script.
8:48That's sick. All right, he has a little
8:50demonstration here.
8:52Uh
8:53one.
8:54Okay. Oh, dude. Invisible.js,
8:58a hoisted payload to write invisible
9:00code. And they give us an example here.
9:03And hint, select the script tag to see
9:06the underlying code. Oh, so like
9:07highlight it. Like
9:09Oh, yeah, cuz I was doing that in an
9:11image earlier. But oh, see, again, I'm
9:14just highlighting. I I initially think
9:17of like the snow tool and like
9:19steganography challenges or in a CTF or
9:22capture the flag of tabs and spaces to
9:25indicate zero and one. Are they using
9:27something similar here just with
9:30Unicode? They have a little demo here on
9:32the website. And again, link in the
9:33video description. But it's a super
9:35compact 116-byte bootstrap that hides
9:38JavaScript using a proxy trap and then
9:41runs the code. When invisible property
9:43is accessed, the property name is
9:44converted to binary, so zeros and ones,
9:47decoded to text, and then executed with
9:49eval. Big shout-out Martin Klepp, AEMKI.
9:53So they have an example we we run and
9:56click to convert to like see the actual
9:59syntax that comes through. Okay, in the
10:01invisible code like a big chunk of it is
10:04there, but that little harness like this
10:06line here will still execute it, right?
10:09You could click run the code to detonate
10:11it.
10:13Let me change this.
10:14Alert, please subscribe. Haha.
10:18And we click to run the code.
10:22And that's it. This is it. This is the
10:24malware.
10:24>> [laughter]
10:25>> Let me say I did poke and play with this
10:27a little bit earlier.
10:29This line, this syntax like the top
10:31harness, the little bootstrapped line to
10:33be able to execute it, will trigger
10:35Windows Defender. Your antivirus will
10:38signature that line. Oh, and he has an
10:40example down below or an explanation.
10:42You use a proxy with a property trap set
10:45to execute code with eval, converting it
10:47all to ones and zeros, so binary, get
10:49the byte sequence, and then do the
10:51thing.
10:52Whoa. That's just so cool. Okay, so how
10:56specifically is this used in the Glass
11:00Worm malware is what I want to know. The
11:03Hangul Filler Unicode characters
11:06that values here are blank, right? You
11:10could copy that text cuz it's not going
11:12to be displayed. And he uses another
11:14separate one, Unicode character FFA0
11:17that is just a little bit thinner, so
11:19half-width Hangul Filler character. And
11:22that is what they use. However, folks
11:24might be pretty accustomed to usually
11:26seeing 200B as like a zero-width space
11:29character. And there are others, like
11:31there are a lot of others that look like
11:33this. Or granted, they don't look like
11:35anything, right? Cuz the zero width
11:37doesn't have it displayed whatsoever.
11:39But Unicode character 200C will do the
11:41same thing. There is 200D, and that's a
11:45zero-width joiner. Again, not displayed,
11:47zero width. So, when we go look back at
11:50Koi and their write-up, they showed this
11:53little picture when we got to see all of
11:55that space they are taking up here. So,
11:58that is including
12:00characters that are displayed. Like that
12:02was the Hangul Filler characters we saw
12:04in Unicode, but that's one option. I've
12:07been trying to keep track of all the
12:08different like headlines and articles
12:10and stories and write-ups and threat
12:12intel reports of folks chatting about
12:14Glass Worm because it is just kind of
12:17bonkers, and I love that trick. I know
12:21Koi was covering it. I know Secure Annex
12:24was covering it, but all Look at this
12:25one. So, that has no width like inside
12:29of those two backticks of the string of
12:31a string in JavaScript. They're
12:33selecting 3,536
12:35characters that you just can't even see.
12:37But are those all the zero-width space
12:40ones that we saw? Not the Hangul Filler
12:44characters.
12:46Who else has been tracking? Oh, Akido.
12:48Akido, I'm sorry. I can never get the
12:49name right. Here's their recent blog,
12:52The Return of the Invisible Threat.
12:54Hidden PUA Unicode hits GitHub
12:58repositories. Oh, cool cool cool cool
13:01cool. This technique might sound
13:03familiar. Hidden malicious code injected
13:05with invisible Unicode private use area
13:08characters. But they actually have a
13:10sweet timeline here. March, they are
13:12seeing that in NPM packages. May, they
13:15cover a bit of a blog on that. October
13:1717th, there's more of it. Koi sees it
13:20and then calls it Glass Worm. And they
13:23also now are tracking this in GitHub
13:24repositories. Secure Annex is tracking
13:26it in Visual Studio Marketplaces. So,
13:29this is all over the place. But they
13:31have a different harness here. At the
13:33end of different commits in the GitHub
13:35repository, each had a single identical
13:38addition. Constant value variable named
13:41D also set to S
13:44mapping the characters or each
13:46individual thing of an S payload like a
13:49string, I think. Mapping like Okay,
13:52taking a character C and at that
13:55position if it's in the range of 0xFE00
14:00and 0xFE0F
14:04or others, then take the value that you
14:08saw, subtract some other hex value, and
14:10add 16. Otherwise, don't include it,
14:14filter it out, and eval from it.
14:16Evaluate from a buffer pulling together
14:19that D string that you've just made. So,
14:22it'll execute code, but it's so cool.
14:24Can you spot the malware? At first
14:26glance, it's hard to see what's going
14:27on. Of course, you see the eval, but the
14:30D call here, that is the payload that is
14:35now invisible. It uses invisible Unicode
14:37characters, hidden code encoded with the
14:39private use area symbols. What are
14:42private use area symbols?
14:44Oh, oh oh oh oh oh. Okay, so these are
14:47all reserved Well, like not officially
14:50used as character sets for Unicode. But
14:53look, you can all see the same hex
14:55values that it was trying to reference
14:58when it was setting the bounds for the
15:00code that it would create based off of
15:02these
15:03again, just used in there, but not
15:05actually displayed and not even having
15:07any width. So, this is what they made
15:11>> [laughter]
15:11>> malicious payloads and malware out of.
15:13That's so bonkers. They have a ton of
15:16free rein here. You could have whatever
15:18character you want. I guess that's why
15:20they like subtracted out the initial
15:22value or one of those starting ranges.
15:25But that explains why we saw those hex
15:27values in that little mapping in
15:30JavaScript. So, look, I wanted to put
15:33together this video if even just to
15:35ramble and rant. I know I'm yapping a
15:36little bit. I didn't have as much of a
15:38demo as I wanted to for this video
15:40because
15:41I was trying to think of oh, how else
15:42could we make a cool demo for this,
15:44light off some fireworks. And I got to
15:45thinking like, well, could we make some
15:48fishing page or website where maybe we
15:50have the white space hidden within HTML?
15:54Like the tag or tabs that indent
15:57specific HTML tags in a rendered page.
16:00And you'd never see that. Even if you
16:02were to view source, okay, you're not
16:03going to usually look highlight over
16:05that and try and track it down. Or can
16:07we hide this in CSS? Like cascading
16:10style sheets. Maybe then you wouldn't be
16:12able to access it via a JavaScript that
16:14you load even externally if you want to
16:16try and hide the harness or the like
16:19bootstrapping little binding. Or what if
16:21in GitHub you just did this sort of
16:23technique for these hidden Unicode
16:25characters and put that in a file no
16:27one's ever going to look at. Use that as
16:30a little execution proxy from the
16:32license file
16:34from some CDN like a giant jQuery blob
16:38that's minified and already looks
16:40disgusting that no one will read anyway.
16:42There are a lot of clever tricks you
16:44could do. So, I did want to again just
16:46add more of an example here. I saw this
16:49recently from Internet Storm Center of
16:51SANS, a phishing email with the
16:54invisible characters in the subject
16:56line. And this is cool, just another
16:58real-world showcase of this with other
17:00context that's not strictly a supply
17:03chain threat, but even using these
17:05silly, stupid, invisible characters,
17:07these Unicode techniques to try to muff
17:11up maybe what any email looks like. So,
17:14then you could just slip right past
17:16email filters or any other security
17:19mechanisms and automated solutions that
17:21just don't quite know what they're
17:22looking at anymore. Because what if the
17:25actual message had now placed in between
17:29Unicode characters that aren't going to
17:31render when they're displayed in your
17:33email clients, but are still something
17:35that break up the text and hinder and
17:38hurt some signature matching. Maybe that
17:41wasn't as visible in that picture, but
17:43like look at this kind of scenario here.
17:45The words your password is set to
17:48expire, but then chunked up and broken
17:52by all of those specific then HTML
17:55escapes &persand SHY. But those are the
17:58Unicode characters that are now ruining
18:00that string, but the end user is none
18:03the wiser, and that cleanly lands in
18:06their inbox as some fish potential risk
18:09and threat. You can see it a little bit
18:11broken in like the inbox display, but
18:13then when you actually take a look at
18:15the email, it's rendered just fine. All
18:17because of invisible Unicode characters.
18:21Got to keep an eye out for them. Got to
18:23Got to keep an eye out for what you
18:24can't see.
18:25Look, I've been trying to make a list of
18:27all those different Unicode characters
18:28and like their representation and how
18:30they could be used and abused. And
18:33again, thinking of all those different
18:34cases where Look, where could this be
18:37creatively put that hackers might be
18:39using it to do whatever they want to do.
18:42And what is the technique? I know Okay,
18:44we're just mapping from like a binary
18:46value. One character represents a zero,
18:48another character represents a one, and
18:50then when you treat that as a binary
18:52interpretation, it just creates code to
18:55execute. What if we got a little bit
18:58clever and said, look, what if couple of
18:59those are just indicators that there
19:01will be a new line? Or it's hidden in
19:03comments. Or it's hidden at the very
19:05beginning or end of when you have
19:06indentation for Python or C++ or
19:09JavaScript like for loop or if statement
19:12where you indent code. You might not
19:15ever notice that if it's tucked away and
19:18hidden in a way that you're not going to
19:20immediately identify it unless your
19:23tool, your text editor, GitHub, or
19:26something helps indicate that there is
19:28weird Unicode characters there. If you
19:31even open it to begin with. So again,
19:34I'm sorry. I know I'm getting wrapped
19:35around the axle because I just think
19:37this is a cool, crafty little technique
19:39as simple, small, and stupid as more
19:43Unicode characters, but those always
19:46tend to be the things that we fall for.
19:49So, want to get more education awareness
19:51out on that. Look at all those different
19:52variations, how that could be done with
19:54a couple of different characters, zero
19:56width or not. But I'm done rambling.
19:57That's the end of the video. Thanks so
19:58much for watching. Please do give Flare
20:00some love, link in the video
20:01description, and I'll see you in the
20:02next video.