SANDWORM_MODE

malware · malware:sandworm-mode single-source

Multi-stage npm supply-chain worm (discovered Feb 2026, documented by CrowdStrike 2026-07-21) that 'lives off the AI toolchain' — it poisons Model Context Protocol (MCP) tool-provider configs in AI coding assistants (Cursor, VS Code, Claude Desktop, Windsurf), injects global git-template hooks for persistence, and exfiltrates npm/AWS/SSH credentials and multi-provider LLM API keys, delaying activation 48–96 h on workstations to defeat install-versus-behaviour correlation and falling back to DNS tunnelling for exfil. NOT the Russian GRU actor Sandworm (actor:sandworm) — the name collision is coincidental and no relation should be drawn between them.

Coverage timeline

first 2026-07-23 → last 2026-07-23

Peak priority

notable

1 notable

Sources cited

2 hosts

Sections touched

research

Co-occurring entities

no co-occurrence

ATT&CK techniques

pinned v19.1 · see below

Hunting pivots

ATT&CK techniques

T1071.004 T1195.002 T1497 T1546 T1552.001

Affected products

Claude DesktopCursorModel Context Protocol (MCP)Visual Studio CodeWindsurfnpm

ATT&CK techniques

5 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1195.002Supply Chain Compromise: Compromise Software Supply Chain×1

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-07-23/sandworm-mode-npm-ai-toolchain-supply-chain-worm-mcp · ATT&CK page ↗

Persistence TA0003

T1546Event Triggered Execution×1

Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.

Evidence: 2026-07-23/sandworm-mode-npm-ai-toolchain-supply-chain-worm-mcp · ATT&CK page ↗

Privilege Escalation TA0004

T1546Event Triggered Execution×1

Evidence: 2026-07-23/sandworm-mode-npm-ai-toolchain-supply-chain-worm-mcp · ATT&CK page ↗

Stealth TA0005

T1497Virtualization/Sandbox Evasion×1

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-07-23/sandworm-mode-npm-ai-toolchain-supply-chain-worm-mcp · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-07-23/sandworm-mode-npm-ai-toolchain-supply-chain-worm-mcp · ATT&CK page ↗

Discovery TA0007

T1497Virtualization/Sandbox Evasion×1

Evidence: 2026-07-23/sandworm-mode-npm-ai-toolchain-supply-chain-worm-mcp · ATT&CK page ↗

Command and Control TA0011

T1071.004Application Layer Protocol: DNS×1

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-07-23/sandworm-mode-npm-ai-toolchain-supply-chain-worm-mcp · ATT&CK page ↗

Story timeline

2026-07-23SANDWORM_MODE — an npm supply-chain worm that 'lives off the AI toolchain', poisoning MCP servers in AI coding assistants to steal developer credentials
researchCrowdStrike documents SANDWORM_MODE, an npm worm that abuses AI coding-assistant MCP configs and git hooks to harvest developer credentials

Where this entity is cited

research1

Source distribution

crowdstrike.com1 (50%)
securitybrief.com.au1 (50%)

explore in graph

All cited sources (2)

Entries about SANDWORM_MODE (1)

2026-07-23 · view entry permalink →

NOTABLENATOB2

SANDWORM_MODE — an npm supply-chain worm that 'lives off the AI toolchain', poisoning MCP servers in AI coding assistants to steal developer credentials

CrowdStrike's research describes SANDWORM_MODE as a multi-stage npm supply-chain worm (first discovered February 2026) that targets AI-augmented developer workflows rather than only conventional package distribution or build systems — what CrowdStrike frames as "living off the AI toolchain," abusing the normalised runtime behaviours of AI coding assistants, CI automation and LLM tooling so its actions blend into legitimate developer telemetry (CrowdStrike, 2026-07-21). On install the worm writes unexpected entries into AI coding-assistant configuration files (Claude Desktop, Cursor, VS Code, Windsurf) that register a rogue Model Context Protocol (MCP) tool provider staged in a hidden directory, and it injects hooks under the global git-template hooks path so persistence fires on future git operations. It then harvests credentials from environment variables and .env/SSH-key files — npm tokens, AWS keys, SSH keys, and API keys for multiple LLM providers — fingerprints the host to separate developer workstations from CI runners, and delays full activation 48–96 hours on workstations (immediately on CI) specifically to defeat tools that correlate install-time and behaviour signals, falling back to DNS tunnelling when primary exfiltration is blocked (SecurityBrief, 2026-07-22). The load-bearing defender lesson is CrowdStrike's own candour: of 14 investigated behaviours only 9 produced any signal and only 2 met the fidelity bar for customer-visible alerting, because npm publishes, repo pushes, LLM-API calls, credential handling and file writes overlap heavily with legitimate developer and CI activity (CrowdStrike, 2026-07-21).

Defender takeaway

the highest-value single artifact is an unexpected MCP tool-provider entry appearing in an AI coding-assistant config — especially one pointing at a hidden directory — shortly after a package install; baseline those configs and alert on writes that register a new provider. Watch modification of the global git-template hooks path (git config --global init.templateDir and unauthorised writes to it), which yields persistence that outlives the original package, and in process-lineage telemetry surface node/npm process trees performing narrowly-scoped actions against git hooks or AI-config files, correlated with reads of ~/.aws, ~/.ssh and .env followed by egress. The 48–96 h activation delay is a deliberate blind spot for install-to-behaviour correlation — extend telemetry retention and correlation windows beyond 96 h on developer and CI hosts, add review gates before npm publish and git-hook changes, and scope and short-live CI credentials. Triage: developer and CI hosts legitimately spawn node/npm trees and handle credentials constantly — the discriminators are a newly-registered MCP provider in a hidden path, an unexpected global git-template hook, and anomalous outbound DNS volume/entropy from those hosts; any one alone is weak, the sequence is the signal. (SANDWORM_MODE is a malware family and is unrelated to the Russian GRU actor of a similar name.)

SANDWORM_MODE introduces an analogous pattern for AI-augmented development environments: living off the AI toolchain.

Of 14 investigated behaviors, only 9 could produce any signal, and only 2 met the fidelity bar for customer-visible alerting.

CrowdStrike 2026-07-21

research23 Jul 04:34Zsingle-sourceOpen finding ↗

Sources: CrowdStrike · SecurityBrief