SlowMist: GitHub Solidity Interview Projects Planted with Data-Stealing Backdoors, 8 Similar Projects Discovered

In a recent threat intelligence report, Mist disclosed that it received user feedback regarding a GitHub repository named sol-live masquerading as a Solidity interview practice project. The repository conceals commands to download and execute remote scripts in its .vscode/settings.json file, which may trigger malicious payloads when users launch the custom terminal configuration. Analysis by Mist indicates that the associated malware can harvest browser login databases, wallet extension storage, and macOS Keychain files. It also possesses capabilities such as scanning and uploading local files, executing remote commands, providing interactive Shell access, and monitoring the clipboard. On macOS and Linux, execution only occurs if users manually activate the malicious terminal configuration. The attack chain on Windows remains unconfirmed due to issues with quotation mark handling.