GCVE-110-OSM-2026-14796

Fake Solidity developer extension on Open VSX built to look like the Hardhat Solidity extension `NomicFoundation.hardhat-solidity`. Installing it is enough to run the code, because the extension activates at startup. It plants a persistent remote access backdoor on Windows, macOS and Linux and stays quiet if it detects a sandbox or debugger. The listing's download count was inflated to look popular. This is the second round, uploaded after the first listings were removed. It belongs to the EtherDuck wave of the SleepyDuck campaign, which targets Solidity developers who often hold crypto wallets. ## Payload 1: bundled video carrying the backdoor Malicious payload found in: `The Duck Song.mp4` (a 205 MB playable video with about 201 MB of appended archive), launched by `out/components/autoUpdate.js` - Trigger: activation event `onStartupFinished`. `autoUpdate.js` runs the bundled archive extractor on the MP4 (`runBundledSync("The Duck Song.mp4")`). - The archive (magic markers `NYANSTEG`, `NYANB64X`, `NYANARCH`) holds seven files; only the one matching the host OS is written to disk: `invoke.ps1`, `app.msi`, `darwin_arm64`, `darwin_amd64`, `linux_amd64`, `linux_arm64`, `note.txt` (a taunt that no code reads). - Windows: `invoke.ps1` bypasses UAC with UACMe method 39 (COR_PROFILER, drops `%TEMP%\uac39-<guid>\profiler.dll`), excludes the staging directory from Defender, silently installs `app.msi` (ScreenConnect with relay `185[.]232[.]84[.]169:8041`), then cleans up. If Defender or AMSI kills it, it launches `calc.exe` and quits. - macOS and Linux: a Go backdoor is written to `~/.solidity/<os>_<arch>` with a LaunchAgent (`com.solidity.langsupport.runner`) or systemd user unit (`solidity-langsupport-runner.service`). It reads its hub from the Ethereum contract `0xf8a900Db50b3331be6B768bA460BB59f3E40C344` (hub `193[.]57[.]9[.]17:4912` at time of analysis). ## Payload 2: round two anti-analysis Malicious payload found in: `lang-resource-sync.js` (129 new lines at the top of the runner script) - Skips installation if VM vendor strings (VMware, VirtualBox, QEMU, Parallels, KVM) or analysis tools (x64dbg, OllyDbg, windbg, ida, procmon, ProcessHacker, Wireshark, Fiddler, dnSpy) are present. - Flagged version(s): 0.9.2, 0.9.3. Final version 0.9.3 published about 22:40 UTC on Sep 25, 2026; removed Sep 26, 2026 at 17:35 UTC. Download counts were reported as about 347k inflated downloads in about 24 hours against about 98k lifetime for the real extension.