Glassworm Used Invisible Unicode Characters to Hide Malware in Code

CrowdStrike, Google, and Shadowserver dismantled the Glassworm botnet on May 26, 2026, which had infected 433 open-source packages since early 2025. The botnet embedded malicious payloads in Unicode Private Use Area characters—rendering them invisible during code review. This steganographic technique marks a meaningful escalation in supply chain attacks, allowing malware to persist through standard developer inspection processes while remaining functionally active.