🚨 Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor @SlowMist_Team recently received user reports about a GitHub repository named sol-live, presented as a #Solidity interview practice project. Analysis revealed a hidden download-and-execute command in .vscode/settings.json that can run a remote script when the project's custom terminal configuration is launched. 🔍 The retrieved payload contains three main modules capable of: 🔹 Collecting browser login databases and wallet extension storage, and copying #macOS Keychain files 🔹 Scanning and uploading local files 🔹 Executing remote commands, providing interactive shell access, and monitoring clipboard contents ⚠️ On macOS/Linux, execution requires users to actively launch the malicious terminal configuration. The #Windows execution chain remains unconfirmed due to potential quoting issues. We also identified 8 other #GitHub projects with similar terminal-based download-and-execute techniques. The analysis does not confirm the actual scope of infection or whether data was exfiltrated. 🛡️ Recommendations: Review .vscode/settings.json and terminal launch arguments before using untrusted projects. If execution is confirmed or cannot be ruled out, isolate and investigate the affected host, then migrate wallet assets and rotate relevant credentials from a trusted device. Read the full analysis 👇 https://slowmist.medium.com/threat-intelligence-beware-web3-interview-questions-conceal-a-data-stealing-backdoor-615cebdcb21c