Malicious TRAE IDE extension "juannegro.solidity" found by SlowMist exploits smart contracts for dynamic C2 config. It's a cross-platform malware dropper, disguising itself as a Solidity plugin, auto-executing on IDE launch & gaining persistence. Attackers can update C2 endpoints/payloads without redeploying the extension, boosting stealth. Removed from Open VSX but was on TRAE marketplace July 18. Users advised to remove immediately & scan systems.
#crypto #blockchain #news
Blockchain Report
npub1cg…nmysr
2026-07-20 10:31:18 UTC
Author Public Key
npub1cg2ejqexhx88llcve0yxts2exv5q9k0a88l69q0vp7y5n0f2xyfscnmysrPublished at
2026-07-20 10:31:18 UTCEvent JSON
{
"id": "8320cb31f7c9be1539332cc1bba0740d4c87dd21e06b5e775665392dec6956e6",
"pubkey": "c215990326b98e7fff0ccbc865c159332802d9fd39ffa281ec0f8949bd2a3113",
"created_at": 1784543478,
"kind": 1,
"tags": [],
"content": "Malicious TRAE IDE extension \"juannegro.solidity\" found by SlowMist exploits smart contracts for dynamic C2 config. It's a cross-platform malware dropper, disguising itself as a Solidity plugin, auto-executing on IDE launch \u0026 gaining persistence. Attackers can update C2 endpoints/payloads without redeploying the extension, boosting stealth. Removed from Open VSX but was on TRAE marketplace July 18. Users advised to remove immediately \u0026 scan systems.\n\n#crypto #blockchain #news ",
"sig": "724b3c5604efcd3678e6ba83937853ac6554b8587bdc6c7f3e480800a96d34b3eadb5937cc1bb542bbd55b7aaa698dce649860f3d7ded6a9e0e9f5794dd83874"
}