Threat reportMalwareTL-2026-4303
Malicious GitHub 'sol-live' Solidity interview project hides data-stealing backdoor in VS Code settings
Malicious GitHub 'sol-live' Solidity interview project hides (TL-2026-4303), also tracked as sol-live, is a high-severity malware campaign, first published 2026-10-23. It has no confirmed attribution, affects Microsoft Visual Studio Code (workspace settings / integrated, maps to 9 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4303
- Threat ID
- TL-2026-4303
- Also known as
- sol-live, Web3 interview questions data-stealing backdoor
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, web3, blockchain, software-development, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Malicious GitHub 'sol-live' Solidity interview project hides
Malware and tooling: RemCom, sol-live data-stealing backdoor, Visual Studio Code
How Malicious GitHub 'sol-live' Solidity interview project hides works
SlowMist reports a GitHub repository named sol-live, disguised as a Solidity interview practice project, that embeds a hidden download-and-execute command in .vscode/settings.json. The payload steals browser login databases, wallet extension storage and macOS Keychain files, uploads local files, and provides remote command execution, an interactive shell and clipboard monitoring. SlowMist found 8 other GitHub projects using a similar terminal download-and-execute technique.
On 2026-10-23 SlowMist disclosed a malicious GitHub repository named sol-live, presented as a Solidity interview practice project aimed at Web3 developers. The lure is a coding-assessment workflow: a candidate is asked to clone and open the project in VS Code, a pattern commonly used in fake-recruiter campaigns against blockchain engineers.
The infection vector is the VS Code workspace settings file .vscode/settings.json. It contains a download-and-execute command unrelated to smart-contract practice. Hundreds of spaces are inserted before the command so that it is pushed out of view when the file is opened in an editor, and file exclusion rules are used to hide the .vscode directory from the project's file tree. According to SlowMist, on macOS and Linux the malicious custom terminal configuration must be actively launched by the user (opening a terminal in the workspace) for execution to occur. The Windows attack chain is unconfirmed; SlowMist's coverage attributes this to quote-handling issues.
The retrieved payload is described as having three functional modules. It collects browser login databases and wallet extension storage data, copies macOS Keychain files, and scans and uploads local files. It also provides remote command execution with interactive shell access, and monitors clipboard contents. This combination enables both immediate cryptocurrency and credential theft and persistent hands-on-keyboard access.
SlowMist identified 8 other GitHub projects using a similar terminal-based download-and-execute technique; their names were not disclosed in the available coverage. The extent of infection and actual data exfiltration are unconfirmed. No CVE, CVSS score, attribution, domains, IP addresses or file hashes were published in any accessible source (the primary SlowMist Medium article returned HTTP 403 to retrieval; facts are corroborated across multiple news mirrors of the report). Because no network indicators exist, no BeaconBeagle C2 correlation was possible.
Recommended response from the source: inspect .vscode/settings.json before running untrusted projects; if the project was run, isolate the device and migrate wallet assets using a trusted system.
MITRE ATT&CK techniques used in TL-2026-4303
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1564.012 File/Path Exclusions
Execution
T1059.004 Unix Shell; T1204.002 Malicious File
Credential Access
T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Initial Access
Affected products and versions in Malicious GitHub 'sol-live' Solidity interview project hides
- Microsoft — Visual Studio Code (workspace settings / integrated terminal)
Vulnerable versions: Any version opening an untrusted workspace; macOS and Linux execution confirmed, Windows unconfirmed - Apple — macOS (Keychain and browser data targeted)
Vulnerable versions: Developer workstations running the payload
Remediation for Malicious GitHub 'sol-live' Solidity interview project hides
Immediate actions
- Do not open or run untrusted interview or coding-test repositories on a workstation holding wallets or credentials
- Inspect .vscode/settings.json (and .vscode/tasks.json) for unexpected commands, excessive leading whitespace and files.exclude entries hiding the .vscode directory
- If sol-live or a similar repository was opened or a terminal launched in it, isolate the device and migrate wallet assets from a trusted system
- Rotate browser-stored credentials and invalidate sessions; treat macOS Keychain contents as compromised
Workarounds
- Show hidden/excluded files in VS Code before trusting a workspace
- Restrict outbound network access from developer terminals where feasible
Longer-term hardening
- Open untrusted repositories only in disposable VMs or containers
- Keep VS Code Workspace Trust enabled and review workspaces in Restricted Mode
- Hunt for editor-spawned shells making outbound downloads (curl/wget piped to a shell)
- Educate Web3 developers about fake-recruiter and take-home-assignment lures
Weaknesses (CWE) in Malicious GitHub 'sol-live' Solidity interview project hides
Timeline of Malicious GitHub 'sol-live' Solidity interview project hides
- Report syndicated by TechFlow, KuCoin News, ChainCatcher, PANews, Phemex and Coinfomania, advising users to inspect .vscode/settings.json and migrate wallet assets if executed
- SlowMist notes macOS/Linux execution requires the user to launch the malicious terminal configuration; Windows attack chain unconfirmed due to quote-handling issues
- SlowMist reports 8 other GitHub projects using a similar terminal-based download-and-execute technique; infection extent unconfirmed
- Retrieved payload analysed: collects browser login databases and wallet extension storage, copies macOS Keychain files, scans and uploads local files, provides remote command execution, interactive shell and clipboard monitoring
- SlowMist identifies a download-and-execute command in .vscode/settings.json padded with hundreds of spaces and hidden with file exclusion rules
- SlowMist publicly discloses the malicious GitHub repository sol-live, disguised as a Solidity interview practice project, via its Medium threat-intelligence post and an X announcement
Sources cited for Malicious GitHub 'sol-live' Solidity interview project hides
- SlowMist: Beware Web3 interview questions conceal a data-stealing backdoor (original report, Medium)
- SlowMist: GitHub Solidity Interview Projects Planted with Data-Stealing Backdoors, 8 Similar Projects Discovered
- SlowMist Discovers Data-Stealing Backdoor in Solidity Interview Project on GitHub
- SlowMist Discovers GitHub Project Disguised as Solidity Interview Practice Contains Spyware Backdoor
- Slow Mist: GitHub Solidity interview project... (ChainCatcher)
- SlowMist Exposes Malicious GitHub Project: Disguised as a Solidity Interview Exercise (PANews)
- GitHub Repository Exposes Data-Stealing Threat to Solidity (Coinfomania)
- SlowMist_Team announcement on X
Detection coverage for TL-2026-4303
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4303 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.