Solidity Pro Extension Steals Crypto Wallets and API Keys via 2 Malicious VS Code Listings
Updated
Updated · The Hacker News · Aug 10
Solidity Pro Extension Steals Crypto Wallets and API Keys via 2 Malicious VS Code Listings
3 articles · Updated · The Hacker News · Aug 10
Summary
Yeeth Security said two "Solidity Pro" VS Code listings delivered a stealer that harvested browser profiles, crypto wallets, API keys, SSH keys and Telegram bot tokens, then exfiltrated the data through a Telegram bot.
Versions 1.0.0 to 2.4.x fetched an encrypted Python payload from Cloudflare Workers, while v3.0.0 and later shifted to a fuller information stealer targeting GitHub, GitLab, AWS, Cloudflare and OpenAI credentials alongside seed phrases and wallet vaults.
The malware used heavy obfuscation, delayed activation and intermittent clean releases to evade marketplace review and sandboxing, with one GitHub repository for web3devtoolsx/solidity-pro still accessible even though the extensions were removed from Open VSX.
The campaign mirrors tactics seen in the WhiteCobra cluster and follows Yeeth's June 2026 discovery of a fake Solidity support extension that swapped copied crypto addresses; the latest findings also tie into rogue npm packages and 10 other VS Code extensions dropping Windows payloads.
Users who installed the extensions were urged to remove them, inspect dependency graphs, block known C2 domains and watch for cscript, mshta, cmd, curl and powershell activity.
How did a massive malware campaign bypass security reviews using delayed activation?
Could your trusted coding tools be secretly draining your crypto wallets while you sleep?
IDE Extensions: The New Primary Attack Surface—Lessons from the Solidity Pro and Counterfeit Solidity Campaigns (2024–2026)
Overview
In late 2024, cybersecurity researchers uncovered the 'Solidity Pro' campaign, where threat actors published compromised VS Code extensions targeting blockchain developers. Early versions of these extensions secretly contacted Cloudflare Workers to download encrypted Python payloads, which ran outside the editor. Later versions evolved to directly search local files and browser profiles for sensitive credentials, exfiltrating them via Telegram bots. Even after marketplace removal, affected developers had to rotate credentials and move cryptocurrency assets. The campaign highlights how attackers use typosquatting, fake download counts, and multi-stage malware to exploit developer tools, leading to major financial losses and exposing the risks of unregulated extension ecosystems.