The TRAE Extension Backdoor That Ran Its C2 on an Ethereum Contract

A fake Solidity plugin, juannegro.solidity, backdoors Windows, macOS, and Linux dev machines and reads its C2 address from an Ethereum contract the attacker updates on-chain.