Slow Mist: GitHub Solidity interview project was implanted with a data theft backdoor, and 8 similar projects have been discovered

Slow Fog released a threat intelligence report stating that they recently received user feedback about a GitHub repository named sol-live, which disguises itself as a Solidity interview practice project. However, it hides commands in the .vscode/settings.json file to download and execute remote scripts, which may trigger malicious payloads when users start the project with custom terminal configurations.

Slow Fog's analysis shows that the related malicious payloads can collect browser login databases, wallet extension storage, and macOS Keychain files. They also have the capability to scan and upload local files, execute remote commands, provide interactive Shell access, and monitor the clipboard. In macOS and Linux environments, the malicious terminal configuration must be actively initiated by the user to execute; the attack chain on Windows has not been confirmed due to issues with quote handling.