Fake Solidity VSCode extension on Open VSX backdoors developers

A malicious remote access trojan called SleepyDuck was distributed via a fake 'juan-bianco.solidity-vlang' extension on the Open VSX registry; initially benign at submission, it received a malicious update and has been downloaded over 53,000 times. The malware activates on editor startup or when compiling Solidity, collects host identifiers (hostname, username, MAC, timezone), and establishes a resilient C2 by reading configuration (including server addresses and polling intervals) from an Ethereum smart contract, enabling updates even if the primary C2 is taken down.