According to cybersecurity firm Aikido, the GlassWorm malware has recently been upgraded to use the Solana transaction memo field as a covert communication channel to receive C2 commands, enabling multi-stage attacks. The malicious program spreads by impersonating open-source packages such as npm and PyPI, and can steal private keys, mnemonics, browser cookies, session data, and deploy remote control Trojans (RATs). The attack also targets hardware wallets like Ledger and Trezor by displaying fake interfaces to trick users into entering their mnemonics, while supporting keystroke logging, screenshots, and remote command execution. Researchers warn developers to be cautious when installing dependencies and to verify package sources. (The Hacker News)