Cyware Daily Threat Intelligence, February 03, 2026
The GlassWorm malware has resurfaced with a specialized focus on macOS, infiltrating the software supply chain by hijacking legitimate developer accounts on the OpenVSX marketplace. Disguised as routine updates for popular extensions, the malware uses invisible Unicode characters to hide its malicious logic from standard code reviews. Once a developer installs the update, GlassWorm establishes a persistent bridge to the system.
The OpenClaw AI assistant ecosystem has been flooded with over 230 malicious "skills" that exploit the platform’s rapid rebranding and minimal security oversight. These malicious add-ons often masquerade as sophisticated crypto-trading tools, complete with professional documentation that lures users into installing a fake "AuthTool" utility. In reality, this tool functions as a credential harvester, quietly exfiltrating API keys and browser passwords to a central server.
Russian-linked hackers from APT28 are currently weaponizing a critical, newly patched Microsoft Office 0-day to target government entities across Ukraine and the EU. By distributing phishing emails with "consultation" documents, the group bypasses traditional OLE security protections to execute shellcode directly through WebDAV-based infection chains. The attackers have demonstrated remarkable speed, often registering their infrastructure the same day a patch is released to catch organizations before they can update.
Top Malware Reported in the Last 24 Hours
New GlassWorm attack targets macOS users
A new GlassWorm malware attack has emerged, targeting macOS systems through compromised OpenVSX extensions. The threat actor gained access to the account of a legitimate developer, pushing malicious updates to four extensions that were downloaded over 22,000 times. First seen in late October, GlassWorm employs invisible Unicode characters to hide its code while stealing cryptocurrency wallet and developer account details. The malware also supports VNC-based remote access and SOCKS proxying. Recent campaigns have shown the malware evolving, specifically targeting macOS and pulling instructions from Solana transaction memos, while notably excluding Russian-locale systems. The malware establishes persistence on infected systems via a LaunchAgent, harvesting sensitive data from browsers and local files, ultimately exfiltrating the information to the attacker’s infrastructure.
Malicious MoltBot skills spread password-stealing malware
More than 230 malicious packages, known as "skills," have been published for the OpenClaw AI assistant, posing significant security risks. These skills masquerade as legitimate tools, delivering malware that steals sensitive information such as API keys, cryptocurrency wallet credentials, and browser passwords. The project, which has undergone multiple name changes from ClawdBot to Moltbot and now OpenClaw, allows users to run a local AI assistant with persistent memory. Security researcher Jamieson O’Reilly revealed that many OpenClaw admin interfaces are misconfigured and exposed online. The malicious skills, attributed to a single campaign, often feature extensive documentation to appear credible, including references to a tool called ‘AuthTool,’ which is actually a malware delivery mechanism.
Top Vulnerabilities Reported in the Last 24 Hours
Russian hackers exploit Office zero-day flaw
Russian hackers, specifically the APT28 group, are exploiting a recently patched Microsoft Office zero-day vulnerability (CVE-2026-21509) in targeted cyber-espionage attacks against Ukrainian and EU government entities. The attackers use phishing emails with weaponized DOC files to deliver the exploit, leveraging a WebDAV-based infection chain to install malware, execute shellcode, and establish persistence. The campaign employs cloud storage service Filen for C2 infrastructure, and CERT-UA advises monitoring or blocking Filen traffic in high-risk environments. The attacks have expanded beyond Ukraine to target EU-based organizations, suggesting a broader regional espionage campaign. The attackers demonstrate rapid operational deployment by registering infrastructure domains on the same day as attacks.
Apache Syncope patches critical security bugs
Apache Syncope has released crucial security updates addressing two significant vulnerabilities: CVE-2026-23794 and CVE-2026-23795. The first, a Reflected Cross-Site Scripting vulnerability rated as "Important," affects the Enduser Login page, allowing attackers to execute arbitrary JavaScript in a user's browser by tricking them into clicking a malicious link. This could lead to session hijacking and unauthorized actions on behalf of the victim. The second vulnerability, rated as "Moderate," is an XML External Entity (XXE) flaw located in the Console component, which requires administrative privileges to exploit. If successfully leveraged, this flaw could result in sensitive data leakage by allowing attackers to access internal files or interact with unauthorized external systems.