TRAE malicious Solidity extension exploits on-chain contracts to dynamically manage C2 configurations

According to the security agency Slow Fog, the malicious TRAE IDE extension juannegro.solidity disguises itself as a Solidity plugin and acts as a cross-platform malware delivery mechanism. This extension automatically executes and establishes persistence after the IDE starts, and it also uses Ethereum smart contracts to store and retrieve dynamic C2 configurations, allowing attackers to update C2 endpoints and payloads without needing to re-release the extension.

Although the extension has been removed from Open VSX, it was still available through the TRAE marketplace as of July 18. Users who have installed it should immediately delete it and check their systems for compromise.