---
title: "SlowMist Uncovers Backdoor Hidden in Fake Web3 Interview Repository"
description: "A malicious Solidity coding test embedded scripts inside VS Code settings to steal crypto wallet data and macOS Keychain files."
url: https://basisdesk.news/news/slowmist-uncovers-fake-web3-interview-backdoor
published: 2026-10-23T11:01:47.484Z
modified: 2026-10-23T11:01:47.484Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: []
tags: [security, malware, vscode, solidity, slowmist, web3]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# SlowMist Uncovers Backdoor Hidden in Fake Web3 Interview Repository

A malicious Solidity coding test embedded scripts inside VS Code settings to steal crypto wallet data and macOS Keychain files.

## At a glance

- **What happened:** SlowMist identified a fraudulent Solidity interview repository that uses hidden VS Code terminal settings to execute data-stealing malware.
- **Why it matters:** The payload targets browser storage, crypto wallet extension directories, and macOS Keychain records on developer machines.
- **Who is affected:** Web3 developers and applicants who downloaded and ran terminals within the sol-live project workspace.
- **What's next:** No next step announced.
- **Primary source:** [Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor](https://slowmist.medium.com/threat-intelligence-beware-web3-interview-questions-conceal-a-data-stealing-backdoor-615cebdcb21c?source=rss-4ceeedda40e8------2) — SlowMist

## Key points

- A fake Solidity interview repository, sol-live, hid execution scripts inside VS Code workspace settings [1].
- Launching project-defined terminals triggers a loader that fetches a 4 MB payload to harvest wallet and keychain data [1].
- SlowMist confirmed the payload launches three background processes targeting browser logins, local files, and clipboard memory [1].

## Editorial remark

- **Context:** Attackers targeting Web3 engineers frequently use recruitment lures and test assignments to compromise developer machines holding access keys and private credentials [1].
- **Impact:** Engineers who cloned and executed the specific repository's terminal environment risk having local wallet browser storage and system credentials exfiltrated [1].
- **Watch:** Developers must review workspace settings files and hidden directory exclusions before running untrusted repositories inside local development environments [1].

A malicious GitHub repository disguised as a Solidity technical interview practice test has been observed deploying a multi-stage backdoor designed to siphon sensitive developer data, according to a security analysis published on Oct. 23 by SlowMist [1].

The repository, titled "sol-live", purported to offer an eight-question Solidity exam to lower candidates' defenses [1]. Behind the coding questions, attackers planted concealed commands in the workspace configuration file located at `.vscode/settings.json` [1]. The operators injected hundreds of spaces to obscure the scripts from immediate view and added exclusion rules in the editor's settings to hide the `.vscode` directory within the VS Code file explorer [1].

When a developer opens the project and launches a workspace terminal on macOS or Linux, the custom configuration executes a command line sequence [1]. The routine inspects the system for Node.js, installs runtime components if absent, writes an initial loader script into a local cache directory, and contacts a remote endpoint to fetch a payload [1]. SlowMist identified the secondary payload as an obfuscated JavaScript bundle of roughly four megabytes [1].

## Data Extraction Pipeline

According to SlowMist's offline script reconstruction, the secondary payload initiates three independent background processes [1]. These dedicated threads handle browser credential harvesting, file discovery and transmission, and remote system control [1]. The analysis determined that the collection routines scan for login databases across 13 Chromium-based browsers, macOS Keychain files, local device files, clipboard contents, and data directories tied to crypto wallet extensions [1].

SlowMist stated that its analysis relied on offline reconstruction, archived source files, and preserved network responses [1]. The firm noted it did not execute the malware sample live, nor did it establish a command-and-control connection on its analysis machines [1]. Although the repository contained a Windows terminal configuration, syntax issues in its PowerShell command string left remote execution unconfirmed on that platform [1]. SlowMist alerted users through its MistEye monitoring network [1].

## Sources

1. [Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor](https://slowmist.medium.com/threat-intelligence-beware-web3-interview-questions-conceal-a-data-stealing-backdoor-615cebdcb21c?source=rss-4ceeedda40e8------2) — SlowMist, 2026-10-23

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai