{"id":286,"date":"2026-03-16T20:05:13","date_gmt":"2026-03-16T20:05:13","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=286"},"modified":"2026-03-16T20:05:13","modified_gmt":"2026-03-16T20:05:13","slug":"glassworm-attack-uses-stolen-github-tokens-to-force-push-malware-into-python-repos","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=286","title":{"rendered":"GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Mar 16, 2026<\/span><\/span>Malware \/ Cryptocurrency<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The GlassWorm malware campaign is being used to fuel an ongoing attack that leverages the stolen GitHub tokens to inject malware into hundreds of Python repositories.<\/p>\n

\u00abThe attack targets Python projects \u2014 including Django apps, ML research code, Streamlit dashboards, and PyPI packages \u2014 by appending obfuscated code to files like setup.py, main.py, and app.py,\u00bb StepSecurity said<\/a>. \u00abAnyone who runs pip install from a compromised repo or clones and executes the code will trigger the malware.\u00bb<\/p>\n

According to the software supply chain security company, the earliest injections date back to March 8, 2026. The attackers, upon gaining access to the developer accounts, rebasing<\/a> the latest legitimate commits on the default branch of the targeted repositories with malicious code, and then force-pushing the changes, while keeping the original commit’s message, author, and author date intact.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

This new offshoot of the GlassWorm campaign has been codenamed ForceMemo. The attack plays out via the following four steps –<\/p>\n