New 'TrapDoor' Virus Steals Crypto Wallets: Solana, DeFi, AI Developers Under Threat

utoday05-25 11:43

Cybersecurity lab SlowMist has issued an emergency security warning under the code SM-2026-352284. According to the official statement, an active cross-registry supply chain attack has been detected, ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2638554829?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-05-25 11:43","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2638554829","market":"hk","top_or_hot":-1,"title":"New 'TrapDoor' Virus Steals Crypto Wallets: Solana, DeFi, AI Developers Under Threat","media":"utoday","content":"<div>\n<p>Cybersecurity lab SlowMist has issued an emergency security warning under the code SM-2026-352284. According to the official statement, an active cross-registry supply chain attack has been detected, ...</p>\n\n<a href=\"https://u.today/new-trapdoor-virus-steals-crypto-wallets-solana-defi-ai-developers-under-threat\">Source Link</a>\n\n</div>\n","source":"utodaynews_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>New 'TrapDoor' Virus Steals Crypto Wallets: Solana, DeFi, AI Developers Under Threat</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nNew 'TrapDoor' Virus Steals Crypto Wallets: Solana, DeFi, AI Developers Under Threat\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-05-25 11:43 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://u.today/new-trapdoor-virus-steals-crypto-wallets-solana-defi-ai-developers-under-threat><strong>utoday</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Cybersecurity lab SlowMist has issued an emergency security warning under the code SM-2026-352284. According to the official statement, an active cross-registry supply chain attack has been detected, ...</p>\n\n<a href=\"https://u.today/new-trapdoor-virus-steals-crypto-wallets-solana-defi-ai-developers-under-threat\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"AIYY","symbol_name":"YIELDMAX AI OPTION INCOME STRATEGY ETF","start_time":0,"source_url":"https://u.today/new-trapdoor-virus-steals-crypto-wallets-solana-defi-ai-developers-under-threat","article_id":"2638554829","we_media_id":null,"thumbnails":[],"rights":{"source":"utodaynews_highlight","url":"https://u.today/new-trapdoor-virus-steals-crypto-wallets-solana-defi-ai-developers-under-threat","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2638554829","pubTimestamp":1779680580,"columns":[],"sourceInfo":{"source_id":"utodaynews_highlight","name":"u.today"},"weMediaInfo":null,"summary":"Cybersecurity labSlowMist has issued an emergency security warning under the code SM-2026-352284. According to the official statement, an active cross-registry supply chain attack has been detected, t","collect":0,"end_time":0,"defaultTopTitle":"u.today","property":[],"viewcount":null,"language":"en","relate_stocks":{"AIYY":"YIELDMAX AI OPTION INCOME STRATEGY ETF","BK4587":"ChatGPT概念","AIPO":"Defiance AI and Power Infrastructure ETF","BK4528":"SaaS概念","BSOL":"Bitwise Solana Staking ETF","SOLT":"2x Solana ETF","SOLZ":"Solana ETF","BK4588":"碎股","SSK":"Rex-Osprey SOL + Staking ETF","AI":"C3.ai, Inc.","BK4551":"寇图资本持仓","AGIX":"通用人工智能 ETF-AGIX","ARTY":"ISHARES FUTURE AI & TECH ETF","CHAT":"ROUNDHILL GENERATIVE AI & TECHNOLOGY ETF","BK4023":"应用软件","GSOL":"Grayscale Solana Trust ETF","BK4543":"AI","SLON":"ProShares Ultra Solana ETF","BK4585":"ETF&股票定投概念","SOLX":"T-REX 2X Long SOL Daily Target ETF"},"translate_title":"新的“活板门”病毒窃取加密钱包：Solana、DeFi、人工智能开发者受到威胁","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"SLON":1.5,"AI":0.75,"ARTY":1.5,"GSOL":1.5,"BSOL":1.5,"SOLZ":0.6,"AIPO":1.5,"AGIX":1.5,"CHAT":1.5,"SOLT":1.5,"SOLX":1.5,"SSK":1.5,"AIYY":0.6},"content_text":"Cybersecurity lab SlowMist has issued an emergency security warning under the code SM-2026-352284. According to the official statement, an active cross-registry supply chain attack has been detected, targeting creators of Web3 and AI products.Hackers injected more than 34 malicious packages and 384 associated versions into the largest repositories, including npm, PyPI and Crates.io, directly targeting developers in the Solana, DeFi, and AI ecosystems.The incident is unfolding against the backdrop of April's anti-record, when the DeFi sector lost an unprecedented $635 million across 28 hacks. Although the scale of direct smart contract exploits declined in May, SlowMist telemetry shows a fundamental change in attacker tactics. Security warning under the code SM-2026-352284 about TrapDoor, Source: SlowMistThreat actors have moved their focus from attacking protected servers to covertly compromising engineers' personal devices.How TrapDoor hijacks \"vibe coding\"SlowMist's analysis showed that TrapDoor is designed for full compromise of developer workstations. The malware steals crypto wallets, cloud tokens such as AWS and GitHub credentials, and access keys, sending them to addresses controlled by the attackers. Conceptually, the scheme repeats the logic of the well-known npm worm \"Mini Shai-Hulud\".To maintain covert persistence in the system, the payload writes itself directly into AI assistant configuration files such as .cursorrules and CLAUDE.md, while also hiding inside Git hooks and automation scripts. In repositories, the software is disguised as AI plugins and build utilities for Sui and Move.The incident is worsened by the trend of \"vibe coding\", where engineers assemble projects through prompts and blindly connect dozens of nested libraries. As a result, AI agents automatically download malicious code onto machines where smart editors have direct access to local configuration files. Due to the critical status of the threat, SlowMist instructs teams to immediately remove the affected packages, isolate infected systems, preserve logs and launch a three-stage remediation protocol:AI configuration audit: Manually inspect local .cursorrules and CLAUDE.md files for third-party or anomalous instructions.Total credential rotation: Force-revoke and reissue all encryption keys, cloud tokens and GitHub secrets used on the devices.Full environment rebuild: Purge and reset build environments, then fully reinstall developer work environments from fresh system images.","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":null,"editions":null,"column":"","sentiment":"-1","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.42.2","shortVersion":"4.42.2","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2638554829","isCrawlerRequest":true}