{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-OSM-2026-14799","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-11-10T09:01:08Z","dateUpdated":"2026-11-09T18:05:06Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"Legitimate, code-signed desktop application whose release automation account appears to have been compromised. Release v0.56.2, labeled an emergency patch release, was built from an unreviewed commit and signed with the project's real certificates, and only that release is affected. It has since been deleted. The same account published a malicious release (13.3.0) of the project's JavaScript client npm package about 30 minutes earlier, and both contact the same attacker server, so the two releases are one incident. The app runs downloaded code on every launch and was offered through its auto-updater to Windows and Apple Silicon Mac users. The later stages steal the Bee node password and wallet key and install a persistent remote access backdoor on macOS, Linux and Windows. The command-and-control design, an Ethereum contract that tells the malware where to connect, matches the SleepyDuck campaign.\n\n## Payload 1: startup loader\n\nMalicious payload found in: `dist/desktop/src/index.js` inside `app.asar` (source `src/index.ts`, malicious commit `2de727046706062d38edfbbf8340f32d1eb2bdfb` on branch `emergency/0.56.2`)\n\n- Trigger: runs first in `main()` on every app launch, before the single-instance lock, splash screen, updater and `app.whenReady`.\n- Behavior: HTTPS GET to `hxxps://api[.]frameworkmetrics[.]xyz/v1/electron` with `User-Agent` set to `process.platform` and an `X-Ethersphere: 1` header, then the response body is run with `new Function('require', 'console', 'process', body)`. Without the header the server returns a decoy.\n- Delivery: signed with the project's Developer ID certificate, notarized, and pushed to Windows x64 and Apple Silicon Macs by the app's auto-updater within minutes of the build. Linux packages are unsigned and do not auto-update. Intel Macs were never offered it.\n- The only other file changed in the release commit is `package.json` (version bump). A follow-up commit `dc7d7455c95b3092eb14bff2bd93315b84b066fa` fixed the broken `pre-release.yml` workflow so the build would complete.\n\n## Payload 2: stage 2 credential theft\n\nMalicious payload found in: JavaScript returned by the server at runtime (no file on disk)\n\n- Reads the Swarm Desktop data directory (`~/Library/Application Support/Swarm Desktop` on macOS, `~/.local/share/Swarm Desktop` on Linux, `%LOCALAPPDATA%\\Swarm Desktop\\Data` on Windows).\n- Posts `config.yaml` (contains the node password in plaintext) and `data-dir/keys/swarm.key` (encrypted Ethereum keystore) to `hxxps://api[.]frameworkmetrics[.]xyz/v1/swarm/report`.\n- Downloads the stage 3 binary for the host OS and architecture from `/v1/assets/` on the same host.\n\n## Payload 3: stage 3 backdoor\n\nMalicious payload found in: platform binaries written to `~/.solidity/` (for example `linux_amd64`, `darwin_arm64`) and `invoke.ps1` on Windows\n\n- macOS and Linux: a Go backdoor (module `evjawbreaker`) started by `~/.solidity/.run.py` (or `.run.cjs` on macOS when Node.js is present). Persistence is the systemd user unit `solidity-langsupport-runner.service` or the LaunchAgent `com.solidity.langsupport.runner`. It exits if a debugger or VM is detected, reads its hub address from an Ethereum contract through public RPC gateways, connects to the hub over TLS without certificate validation, and runs operator commands in a persistent `sh` pty.\n- Windows: an obfuscated PowerShell loader (`invoke.ps1`) stages files under `%TEMP%\\.stuffed-*`, bypasses UAC with UACME method 39 (COR_PROFILER against `mmc.exe`), adds a Microsoft Defender exclusion, and silently installs ConnectWise-signed ScreenConnect 25.4.3 configured for the relay `185[.]232[.]84[.]169:8041`, running as the SYSTEM service `ScreenConnect Client (5cbe79c9c25524df)`.\n- Reinstalling or updating the app does not remove any of these.\n","supportingMedia":null}],"references":[{"url":"https://opensourcemalware.com/threats/f9f0c92d-e974-4eb9-bbf7-e9b6b4762e01","name":"Malicious repository: https://github.com/ethersphere/swarm-desktop","tags":["advisory"]}],"metrics":[{"format":"CVSS_V3","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"unknown","product":"","collectionURL":"","packageName":"","repo":"https://github.com/ethersphere/swarm-desktop","defaultStatus":"affected","versions":[{"version":"all","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}