GCVE-110-OSM-2026-14794

Fake Solidity developer extension on Open VSX built to look like the popular Solidity extension by Juan Blanco. Installing it is enough to run the code, because the extension activates at startup. It plants a persistent remote access backdoor on Windows, macOS and Linux and stays quiet if it detects a sandbox or debugger. It belongs to the EtherDuck wave of the SleepyDuck campaign, which targets Solidity developers who often hold crypto wallets. ## Payload 1: bundled video carrying the backdoor Malicious payload found in: `The Duck Song.mp4` (a 205 MB playable video with about 201 MB of appended archive), launched by `out/components/autoUpdate.js` - Trigger: activation event `onStartupFinished`. `autoUpdate.js` runs the bundled archive extractor on the MP4 (`runBundledSync("The Duck Song.mp4")`). - The archive (magic markers `NYANSTEG`, `NYANB64X`, `NYANARCH`) holds seven files; only the one matching the host OS is written to disk: `invoke.ps1`, `app.msi`, `darwin_arm64`, `darwin_amd64`, `linux_amd64`, `linux_arm64`, `note.txt` (a taunt that no code reads). - Windows: `invoke.ps1` bypasses UAC with UACMe method 39 (COR_PROFILER, drops `%TEMP%\uac39-<guid>\profiler.dll`), excludes the staging directory from Defender, silently installs `app.msi` (ScreenConnect with relay `185[.]232[.]84[.]169:8041`), then cleans up. If Defender or AMSI kills it, it launches `calc.exe` and quits. - macOS and Linux: a Go backdoor is written to `~/.solidity/<os>_<arch>` with a LaunchAgent (`com.solidity.langsupport.runner`) or systemd user unit (`solidity-langsupport-runner.service`). It reads its hub from the Ethereum contract `0xf8a900Db50b3331be6B768bA460BB59f3E40C344` (hub `193[.]57[.]9[.]17:4912` at time of analysis). - Flagged version(s): 0.9.2. Sep 24, 2026 (about 23:42 UTC); removed Sep 25, 2026 at 18:35 UTC, about 19 hours live.