Slow Mist: TRAE Malicious Extension Uses Ethereum Smart Contract to Manage C2 Configuration

According to security agency SlowMist, the malicious TRAE IDE extension juannegro.solidity disguises itself as a Solidity plugin and acts as a cross platform malware delivery tool. The extension automatically executes and establishes persistence after IDE startup, using Ethereum smart contracts to store and retrieve dynamic C2 configurations, allowing attackers to update C2 endpoints and payloads without the need to republish the extension. Although the extension has been removed from Open VSX, it can still be obtained through the TRAE marketplace as of July 18th. Installed users should immediately delete it and check if the system is damaged.