Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor
A GitHub repository named sol-live, presented as a Solidity interview practice project, was found to contain a backdoor that steals browser data, wallet extension storage, macOS Keychain files, and clipboard contents. The backdoor is triggered by malicious VS Code workspace terminal configurations. While the analysis did not confirm plaintext password decryption or data exfiltration, the potential for significant data compromise exists.
- Confidence
- High
- First seen
- 23 Oct 2026, 11:00 UTC