Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor

Key points

• SlowMist reported a GitHub repository named sol-live, posing as a Solidity interview practice project, that hides a download-and-execute command in .vscode/settings.json.
• According to the analysis, malicious terminal configurations for macOS, Linux and Windows fetch and eval a remote obfuscated script of roughly 4 MB.
• SlowMist said the code can launch three background processes for browser data theft, file scanning and uploading, and remote control, targeting wallet extensions and Keychain.

AI summary of SlowMist’s report, written only from the publisher’s text. Read the original for full context.