慢雾 SlowMist

Background
Solidity Pro is a VS Code extension for Solidity/Web3 developers. It is positioned as a development aid tool and offers features such as gas lookups, token prices, code snippets, and compilation hints. Its GitHub repository has also previously advertised security capabilities such as AI Audit and Security Scanner.
In public events, Solidity Pro used two publishers—helper-beeps and web3devtoolsx—for the publisher identity, with Extension IDs (unique extension identifiers) of helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, respectively. Although the publishing identity changed, later build artifacts still retained the old publisher, repository address, and copyright information, indicating a direct engineering inheritance relationship between the two.

Recently, MistTrack Agent, built by SlowMist, officially joined AgentOn as a third-party Agent. Focused on crypto AML and on-chain investigations, MistTrack Agent brings capabilities such as on-chain funds tracing and risk analysis to the AgentOn platform, providing users with a more efficient and automated way to conduct on-chain investigations.
Welcome to MistTrack Agent:
https://agenton.me/agent/market/external/fe204dba-05d1-49c8-8659-03ca24988185
🎁 Limited-time offer: Each user can enjoy 10 free calls, valid for 30 days. After the free call quota is used up or the validity period ends, charges will apply according to AgentOn’s standard pricing.

The continuous development of digital asset and artificial intelligence technologies is driving payments into a new application stage. On the one hand, stablecoins are accelerating their move beyond on-chain scenarios and are being integrated into real business functions such as payments, settlements, and treasury management. On the other hand, AI Agents are gradually evolving from supporting tools into payment participants capable of representing users and enterprises to conduct inquiries, make decisions, call services, and even initiate transactions.
As stablecoins move into real payment scenarios, how can compliance be truly implemented? As AI Agents begin to participate in transactions, how can secure and trustworthy transaction mechanisms be established? These have also become new issues the industry needs to address.

Author: Johan & Lisa
Edit: 77
This article is co-created by humans and machines—you can reproduce it by importing the AI.
Background
On July 30, 2026, on-chain there was a batch of addresses that continuously transferred funds outward. Over 41 minutes, 1,196 single-sig addresses were emptied, with about 1,082 bitcoins disappearing. This was only the first wave. By early August, confirmed losses were at least 1,719 bitcoins—about $111 million—covering more than 5,200 addresses, and the attacker split the activity into three to four waves before and after the attack.
What’s most puzzling is the state of these wallets. Most of the money sat in cold wallets; some had been untouched for months or even years. What was lost was the layer of the private key. All of the private keys were generated by the Coldcard hardware wallet; the owner hadn’t clicked the dice entropy additional times, nor had they enabled a BIP-39 passphrase. Victims were using the most effortless way of doing things.

Recently, SlowMist and AgentOn have officially reached a strategic partnership. The two sides will collaborate on AI agent security capability building, security assessment frameworks, and ecosystem practices, jointly推动ing the AI agent ecosystem toward a safer and more trusted direction.
Background
As AI agents gradually move from demos to real-world scenarios, agent security issues are becoming the most关注 topic across the entire industry. Compared with traditional Web3 products, AI agents have capabilities such as calling tools, accessing data, managing wallets, and executing transactions. Once a security issue occurs, the impact is much broader.

Background
Recently, MistEye detected a credential-stealing campaign targeting Web3 professionals, luring victims with recruitment. The attackers impersonated recruiters to engage job seekers, discussed interview arrangements, and then induced the targets to redirect to relay.lc for further online communication.
This website packages itself as an AI meeting collaboration tool called Relay, claiming it can provide real-time transcription, collaborative notes, AI summaries, action items, and cross-platform clients, among other features. For people attending remote interviews, this pitch doesn’t feel out of place: installing a “meeting app” to proceed to the next round of communication looks like a normal part of the hiring process. The public page for relay.lc also builds its product image around these functions, and it offers download entry points for Windows and macOS.

The MistEye Security Team officially releases MistEye DNS Guard: a lightweight local DNS relay and threat observation tool written in Rust, designed for macOS and Linux hosts. It provides system DNS takeover, domain name and public IP detection, process outbound connection monitoring, malicious event retention, and webhook alerting capabilities. It focuses on common risk scenarios such as accessing malicious domains, DNS responses returning malicious indicators, and programs directly connecting to malicious IPs.
MistEye DNS Guard decouples DNS forwarding from subsequent threat detection: DNS queries are completed as usual, while domain names and IP addresses are asynchronously sent to MistEye for detection in the background, minimizing the impact of security checks on normal network access.

Background
Recently, the SlowMist security team identified a phishing attack that persisted for months and was carried out through multiple channels. The attackers posed as multiple Web3 wallet brands.
We first became aware of this incident through two phishing emails. The attackers impersonated Keystone and OneKey, using reasons such as “Terms of Service update,” “account verification,” and “regulatory compliance,” urging the recipient to complete the action within a specified deadline. The buttons in the email would take the victim to a fake DocuSign page and coax them into downloading a so-called “desktop signing application.”

Background
In July 2026, the Financial Action Task Force (FATF) released its seventh (dedicated progress report on the regulation of virtual assets and virtual asset service providers) [1].
FATF noted that, since 2025, illegal activities involving virtual assets have become more complex and increasingly show a convergence trend. These include the operation of scam centers linked to organized crime groups, “pig-butchering” scams, cyber theft related to North Korea, terrorist financing/proliferation financing (TF/PF), evasion of sanctions, and cross-border money laundering. Stablecoins, peer-to-peer (P2P) transactions conducted via non-custodial wallets, offshore VASPs, OTC brokers, cross-chain tools, and activities related to DeFi continue to pose significant risks. This highlights the need to strengthen public-private cooperation, enhance monitoring, and implement concrete risk-mitigation measures by relevant jurisdictions and the private sector.

Background
Recently, MistEye detected a malicious code delivery campaign that used recruiting as bait and targeted developers. The attacker first contacted developers via LinkedIn, posing as a recruiter for a Web3 project. After discussing the victim’s work experience and interview scheduling, the attacker sent a GitHub repository to the target, claiming it contained the MVP that needed to be tested before the interview.
Chat logs show that the attacker first asked the target about their work experience and product expertise, and then discussed follow-up interview arrangements. Afterwards, the other party said they needed the target to experience the product in advance in order to discuss specific issues during the interview, and used this to request the target to run projects in the repository.

A malicious extension that has been removed from Open VSX but is still downloadable from the extension marketplace of the TRAE IDE. The extension masquerades as a common Solidity language support plugin, with the package name juannegro.solidity. As of July 18, 2026, the TRAE plugin marketplace API still provides version 0.0.189 of this extension (VSIX file).
Reverse engineering shows that this extension is actually a cross-platform (Windows, macOS, Linux) malware dropper. It automatically runs after the IDE starts, creates a user-level persistence (autostart) entry in the system, and then retrieves the download address of subsequent malicious code via an Ethereum smart contract, or directly connects to a remote control Shell address.

Background of the incident
The incident began with Shan Ge (23pds, SlowFog CISO). He saw a claim in the community that Grok CLI might be risky. What the exact risk is and how severe it is—there are many conflicting opinions in the community. I (Thinking, SlowFog’s business security负责人) happened to have a new macOS aarch64 binary of 0.2.98 (SHA-256 d5952131...), so I decided to analyze it myself—rather than speculate. I disassembled the binary, captured the traffic, and restored the uploaded contents to find out what’s actually going on.
After analyzing, the conclusion is more specific than the community rumors: Grok CLI, at the start of each turn, uploads the entire codebase—verbatim and without any redaction— to xAI’s cloud storage via git bundle. This includes .env, .envrc, and config.secret that are excluded by .gitignore. The upload happens before the model receives an inference request, and is completely independent of the “Improve the model” toggle; on the server side, it can also be forcibly enabled via remote settings. I used IDA Pro 9.3 for static decompilation, Frida for runtime byte-level verification, and mitmproxy 12.2.3 for traffic capture. These three lines of investigation cross-validated each other, and I compared against the community-analyzed version 0.2.93—the upload mechanism is completely consistent across the two versions.

Recently, at the first Web4.0 and Agent Innovation Summit held in Hong Kong Cyberport and the launch ceremony of the Cyberport OPC Hub, Cyberport officially announced the establishment of the Web4.0 and Agent Security Alliance. As one of the founding members, SlowMist will work with alliance partners to jointly promote the development of Web4.0 and agent security standards and best practices, contributing its expertise to the growth of a trustworthy Web4.0 ecosystem.
Web4.0 and Agent Security Alliance
As Agentic AI and blockchain technology continue to integrate, agents are gradually gaining capabilities such as autonomously executing tasks, calling tools, and interacting with on-chain systems. While improving production efficiency and driving application innovation, these advancements also introduce new security risks, including prompt injection, supply chain attacks, permission abuse, and AI agent trust-chain risks.

Background
Recently, the MistEye security monitoring system captured a data-stealing trojan running on macOS. The Mist Fog Security team immediately launched an analysis.
Judging from the list of what was stolen, the sample appears to be conducting a broad, non-targeted data sweep: macOS Keychain, Safari cookies, Apple Notes, Telegram Desktop local data, as well as the databases of more than a dozen digital wallets—everything was included in the target scope.
In the previous article 《Google Sites 社群申请钓鱼与 macOS 窃密木马分析》, we answered the question: "What did the trojan steal?" However, copying files does not necessarily mean an account has already been compromised, and taking away a wallet database does not imply that the mnemonic phrase has already been leaked. Therefore, this article further asks:

Background
The starting point of this investigation was a seemingly normal development workflow: a developer installs the official Injective SDK, generates a wallet, imports a mnemonic phrase, or passes an existing private key into the SDK interface. During the installation phase, everything works as expected, and wallet operations may also return results normally. However, at the same time, an extra network request appears in the program’s background that is not part of the normal business logic.
Recently, in threat hunting across the npm ecosystem, the security research company Socket found that the @injectivelabs/sdk-ts version 1.20.21 exhibited abnormal behavior. The SlowMist MistEye security monitoring system also captured this malicious supply-chain attack event. After analysis, it was confirmed that the sample was not a reposted or impersonated package remade by the attacker, but rather a legitimate SDK build artifact containing malicious code. For related public background, please refer to (Compromised Injective SDK npm Package).

Summary
On July 8, 2026, Bruce Xu ( @brucexu_eth ) reported a phishing link disguised as a BuilDAO / Builder community application page. The attacker hosted the page on Google Sites and used the trusted appearance of sites.google.com to reduce users’ vigilance. The first half of the page simulated a community application form, asking users to fill in information such as their location, identity, project link, and reasons for joining. After submission, it did not enter the normal review process; instead, it redirected to a forged security-check page.
On the second-stage page, the attacker forged technical wording such as api_error_401, OAuth 2.0, and macOS security checks to诱导 users to download a .scpt file, or copy the Terminal Command and execute it in the terminal. After decoding, it can be confirmed that the command will download a macOS Mach-O trojan named unix32385485 from the attacker’s server and execute it in the background.

SlowMist is hiring!
If you’re interested in becoming part of our team, please read on.
/ Job Openings /
Job Title: Head of Go-To-Market (GTM) Marketing for AML Products
Work Location: Xiamen / Shenzhen / Hong Kong (optional)
Compensation: Negotiable (assessed comprehensively based on experience, capabilities, and past performance)
What kind of role is this?
As the Head of Go-To-Market (GTM) Marketing for the AML product, you will be responsible for the market entry strategy, product positioning, brand communications, sales enablement, and growth conversions for SlowMist’s AML products (MistTrack / SlowMist KYT). You will help the products continuously expand their market influence.

TrackAgent: An on-chain AI intelligence officer for real stolen-asset cases
TrackAgent is an AI Agent analysis system we built for scenarios involving on-chain tracking of stolen funds. It is not a traditional address lookup tool, nor is it only an automation script that runs a fixed procedure. Instead, it acts like an on-chain detective: it continuously analyzes the fund flow around the case goal, identifies key nodes, determines the tracking direction, and organizes complex on-chain behavior into clues that are understandable, verifiable, and further actionable.
After the user submits the stolen address, the hacker address, the transaction hash, the stolen asset type, the amount, and the incident time, TrackAgent first verifies the starting point of the funds, then gradually traces along the on-chain path. When funds enter an exchange, a DEX, a cross-chain bridge, a mixer, or a collection address, the Agent attempts to identify these key nodes. When funds are exchanged, cross-chained, split, or re-aggregated, the Agent continues to search for subsequent paths instead of stopping at the surface level of a single transaction.

Due to space limitations, this article only lists the key points from the analysis report. For the full content, please access the link below:
https://drive.google.com/file/d/1zfngTKU3_dr10QqXKsQNe1kMhHtfQ7J0/view
1. Overview
In the first half of 2026, while the blockchain industry continues its rapid growth, security threats and the regulatory environment have further evolved. Overall risk structures show a trend toward systematic expansion. As applications such as DeFi, cross-chain infrastructure, and AI Agents accelerate their rollout, the attack surface continues to expand. Security risks have moved beyond smart contracts to include developer ecosystems, supply-chain systems, terminal interaction environments, and user-authorized trust links. Meanwhile, the widespread adoption of AI technology has significantly lowered the threshold for social engineering and automated attacks, driving malicious activities toward greater professionalism, scale, and persistence.

Background
On June 18, 2026, the RollupProcessor contract of the Ethereum Layer2 privacy protocol Aztec Connect was compromised. The attacker exploited its Escape Hatch mechanism, taking advantage of the trust boundary flaw due to the lack of independent fund ownership and withdrawal limit checks at the Solidity layer, as well as missing circuit constraints. They submitted an escape hatch proof accepted by TurboVerifier and directly withdrew 1,158 ETH (about $2.06 million) from the contract balance. Additionally, they stole 150,000 DAI and 0.47 renBTC through the same mechanism, totaling a loss of approximately $2.22 million.