GCVE-110-OSM-2026-14784

Malicious Open VSX extension impersonating the legitimate juanblanco.solidity Solidity extension. On startup it unpacks a payload hidden in an archive appended to a real MP4 and installs a persistent Go backdoor (evjawbreaker) on macOS and Linux. The backdoor reads its C2 address from an Ethereum smart contract (EtherHiding) and gives the operator a persistent shell as the logged-in user. Part of the SleepyDuck/EtherDuck campaign. Malicious payload found in: out/components/autoUpdate.js, The Duck Song.mp4 The extension activates on onStartupFinished. autoUpdate.js launches a hidden, detached Node process that extracts an archive (NYANSTEG/NYANB64X/NYANARCH markers) appended to a 205 MB MP4, checks OS and CPU architecture, and writes the matching Go binary to ~/.solidity/<os>_<arch>. Persistence is a LaunchAgent (macOS) or systemd user service (Linux). The binary reads the C2 address from the Ethereum contract, connects over TLS, and runs base64-encoded shell commands in a pty session. Shell markers: __JAWBRK_EC__, __JAWBRK_DONE__. Go project name: evjawbreaker. Paths: ~/.solidity/, ~/Library/LaunchAgents/com.solidity.langsupport.runner.plist, ~/.config/systemd/user/solidity-langsupport-runner.service Confirmed indicators are recorded in verified_iocs.