# Malicious GitHub 'sol-live' Solidity interview project hides data-stealing backdoor in VS Code settings

> SlowMist reports a GitHub repository named sol-live, disguised as a Solidity interview practice project, that embeds a hidden download-and-execute command in .vscode/settings.json. The payload steals browser login databases, wallet extension storage and macOS Keychain files, uploads local files, and provides remote command execution, an interactive shell and clipboard monitoring. SlowMist found 8 other GitHub projects using a similar terminal download-and-execute technique.

- **Published:** 2026-10-23T19:36:12Z
- **Last reviewed:** 2026-10-23T19:36:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4303
- **ID:** TL-2026-4303
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-23 SlowMist disclosed a malicious GitHub repository named sol-live, presented as a Solidity interview practice project aimed at Web3 developers. The lure is a coding-assessment workflow: a candidate is asked to clone and open the project in VS Code, a pattern commonly used in fake-recruiter campaigns against blockchain engineers.

The infection vector is the VS Code workspace settings file .vscode/settings.json. It contains a download-and-execute command unrelated to smart-contract practice. Hundreds of spaces are inserted before the command so that it is pushed out of view when the file is opened in an editor, and file exclusion rules are used to hide the .vscode directory from the project's file tree. According to SlowMist, on macOS and Linux the malicious custom terminal configuration must be actively launched by the user (opening a terminal in the workspace) for execution to occur. The Windows attack chain is unconfirmed; SlowMist's coverage attributes this to quote-handling issues.

The retrieved payload is described as having three functional modules. It collects browser login databases and wallet extension storage data, copies macOS Keychain files, and scans and uploads local files. It also provides remote command execution with interactive shell access, and monitors clipboard contents. This combination enables both immediate cryptocurrency and credential theft and persistent hands-on-keyboard access.

SlowMist identified 8 other GitHub projects using a similar terminal-based download-and-execute technique; their names were not disclosed in the available coverage. The extent of infection and actual data exfiltration are unconfirmed. No CVE, CVSS score, attribution, domains, IP addresses or file hashes were published in any accessible source (the primary SlowMist Medium article returned HTTP 403 to retrieval; facts are corroborated across multiple news mirrors of the report). Because no network indicators exist, no BeaconBeagle C2 correlation was possible.

Recommended response from the source: inspect .vscode/settings.json before running untrusted projects; if the project was run, isolate the device and migrate wallet assets using a trusted system.

## MITRE ATT&CK

- T1566.003 Spearphishing via Service
- T1204.002 Malicious File
- T1059.004 Unix Shell
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1564.012 File/Path Exclusions
- T1555.003 Credentials from Web Browsers
- T1555.001 Keychain
- T1005 Data from Local System

## Sources

- [SlowMist: Beware Web3 interview questions conceal a data-stealing backdoor (original report, Medium)](https://slowmist.medium.com/threat-intelligence-beware-web3-interview-questions-conceal-a-data-stealing-backdoor-615cebdcb21c)
- [SlowMist: GitHub Solidity Interview Projects Planted with Data-Stealing Backdoors, 8 Similar Projects Discovered](https://www.techflowpost.com/en-US/newsletter/141137)
- [SlowMist Discovers Data-Stealing Backdoor in Solidity Interview Project on GitHub](https://www.kucoin.com/news/flash/slowmist-discovers-data-stealing-backdoor-in-solidity-interview-project-on-github)
- [SlowMist Discovers GitHub Project Disguised as Solidity Interview Practice Contains Spyware Backdoor](https://www.kucoin.com/news/flash/slowmist-discovers-github-project-disguised-as-solidity-interview-practice-contains-spyware-backdoor)
- [Slow Mist: GitHub Solidity interview project... (ChainCatcher)](https://www.chaincatcher.com/en/article/2298512)
- [SlowMist Exposes Malicious GitHub Project: Disguised as a Solidity Interview Exercise (PANews)](https://panews.io/articles/01a16894-ed5c-7572-80f5-bad1834ae5c4)
- [GitHub Repository Exposes Data-Stealing Threat to Solidity (Coinfomania)](https://coinfomania.com/github-repository-exposes-data-stealing-threat-to-solidity/)
- [SlowMist_Team announcement on X](https://x.com/SlowMist_Team/status/2113596120748458244)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4303