Get to know

Lotan Sery

Blogs by Lotan Sery

Sort By:

GlassWorm Wave 5: Malicious MCP Servers and Extensions

GlassWorm Strikes Again: Wave 5 Brings Invisible Code to MCP Servers, GitHub Repos, and Hundreds of Extensions. Five waves. Five months. One relentless threat actor. We first exposed GlassWorm back in October …

Mar 16, 2026

By Lotan Sery

Supply Chain Under Siege: GlassWorm’s Native Rust Loaders Target VS Code

Key Takeaways Shift to Compiled Loaders: GlassWorm abandoned invisible Unicode character obfuscation in favor of compiled native Rust binaries (.node Node.js addons) to complicate static analysis and reverse engineering. Dual-Marketplace Targeting: The …

Dec 10, 2025

By Lotan Sery

The Evolution of GlassWorm: How a Known Threat is Rewriting its Playbook th...

Key Takeaways Second OpenVSX Wave: Three additional OpenVSX extensions were compromised, resulting in an estimated 10,000 additional downloads. Cross-Platform Spread via GitHub: GlassWorm leveraged stolen GitHub credentials to push malicious, seemingly AI-generated …

Nov 06, 2025

By Idan Dardikman, Yuval Ronen and Lotan Sery

Blogs by Lotan Sery

Sort By:

The Evolution of GlassWorm: How a Known Threat is Rewriting its Playbook th...

Nov 06, 2025

By Idan Dardikman, Yuval Ronen and Lotan Sery

Supply Chain Under Siege: GlassWorm’s Native Rust Loaders Target VS Code

Dec 10, 2025

By Lotan Sery

Get the latest news, invites to events, and threat alerts

By submitting this form, I understand my personal data will be processed in accordance with Palo Alto Networks Privacy Statement and Terms of Use.