'Adversaries are no longer just targeting products, they're targeting the developers who build them': CrowdStrike takes down major botnet targeting developers across the world

Abstract image of robots working in an office environment including creating blueprint of robot arm, making a phone call, and typing on a keyboard.

• CrowdStrike, Google, and Shadowserver jointly dismantled the Glassworm botnet on May 26, 2026, by disrupting all four of its resilient C2 channels simultaneously
• Active since early 2025, Glassworm spread via trojanized VSCode extensions, poisoned npm/Python packages, and compromised GitHub repos, stealing developer credentials and deploying GlasswormRAT across Windows, macOS, and Linux
• The takedown highlights a shift in threat focus from products to developers, with coordinated precision required to neutralize its blockchain, BitTorrent DHT, Google Calendar, and VPS‑based infrastructure

Cybersecurity researchers from CrowdStrike, Google, and the Shadowsever Foundation have teamed up to take down a major botnet targeting software developers all over the world.