Solidity Pro VS Code Extensions Steal Crypto Wallets and Developer Credentials

Cybersecurity researchers have uncovered malicious Microsoft Visual Studio Code extensions posing as Solidity development tools. These extensions steal browser crypto wallets, API keys, SSH keys, and cloud credentials from unsuspecting developers. The campaign targets the open-source software supply chain by abusing marketplace trust and evading static detection through heavy obfuscation and delayed activation.

What Happened: Malicious Solidity Pro VS Code Extensions Steal Developer Credentials

Yeeth Security identified two malicious VS Code extensions distributed under the name “solidity-pro” on the Open VSX marketplace. The extensions were published by two different publishers: helper-beeps.solidity-pro and web3devtoolsx.solidity-pro. Consequently, both have since been removed from the marketplace.

However, the GitHub repository for the web3devtoolsx variant remains accessible as of this writing. This raises ongoing concerns about copycat attacks or forked variants reappearing under new names. The incident highlights the persistent risk of developer tooling platforms being weaponized for credential theft.

Technical Details of the Malicious VS Code Extension Campaign

The malware authors employed a multi-stage evasion strategy to bypass marketplace review and static scanning. Early versions of the extensions (v1.0.0 through v2.4.x) beaconed to Cloudflare Workers endpoints to retrieve an encrypted Python payload for execution.

Starting with v3.0.0, the extensions shifted to a full-blown information stealer. The captured data is exfiltrated via a Telegram bot upload. Furthermore, the malware uses randomized delayed activation. This means the malicious code may run hours or even days after installation. By that time, automated scanners have moved on and the user considers the extension trustworthy.

Data Harvested by the Stealer

• GitHub ghp_ and github_pat_ tokens
• GitLab glpat- tokens
• AWS keys and session tokens
• Cloudflare cfat_ tokens
• OpenAI sk-, sk-proj-, and sk-ant- keys
• Telegram bot tokens
• Mnemonic and seed phrases
• MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr wallet vaults
• Bitcoin WIF / xprv private keys
• SSH private keys
• URL credentials and 1Password MFA tokens

Evasion Techniques Used

• Heavy obfuscation: Strings are split across IIFE tables and reassembled at runtime. Method names change between releases to defeat signature-based detection.
• Delayed activation: Malicious branches execute hours or days after installation, well after sandbox observation windows close.
• Intermediate clean versions: Early releases appear benign to build user trust and positive reviews before the malicious payload is introduced.
• First-party API abuse: Clipboard swaps use vscode.env.clipboard.writeText, requiring no child_process or network imports that scanners typically flag.

Business and Operational Impact

The compromise of developer credentials creates cascading risks across organizations. When an attacker gains access to source-control tokens, cloud API keys, and SSH private keys, they can pivot from a single developer workstation to entire CI/CD pipelines and production environments.

• Supply chain compromise: Stolen GitHub and GitLab tokens enable attackers to modify code repositories, inject backdoors into builds, and poison downstream dependencies.
• Cloud infrastructure takeover: AWS and Cloudflare credentials allow direct access to hosted infrastructure, data stores, and DNS configurations.
• Crypto asset theft: Wallet vaults and seed phrases give attackers immediate access to developer and organizational cryptocurrency holdings.
• AI service abuse: Stolen OpenAI keys can be used for model inference abuse, generating disinformation, or incurring massive API charges.
• lateral movement: SSH keys facilitate movement across internal networks and access to production servers.

Moreover, because VS Code extensions run with the privileges of the user who installs them, they can access the entire filesystem, environment variables, and running processes without additional exploitation.

Mitigation and Recommendations

Immediate Actions for Developers and Security Teams

1. Audit installed VS Code extensions and remove any variant of “solidity-pro” or unknown Solidity-related tools.
2. Inspect extension dependency graphs for nested malicious packages, especially those beaconing to Cloudflare Workers or Telegram.
3. Rotate all potentially exposed credentials immediately. This includes GitHub, GitLab, AWS, Cloudflare, OpenAI, and SSH keys.
4. Review source-control and cloud access logs for unauthorized activity from the period the extension was installed.
5. Block known command-and-control domains and Telegram bot upload endpoints at the network perimeter.

Long-Term Defensive Measures

1. Implement allowlisting for VS Code extensions in enterprise environments. Only approved extensions should be installable.
2. Deploy endpoint detection rules that alert on cscript, mshta, cmd, curl, and PowerShell execution from VS Code extension contexts.
3. Require code signing and publisher verification for all marketplace extensions used in production development environments.
4. Segment developer workstations from production credentials using short-lived tokens and just-in-time access.
5. Conduct regular scans of installed extensions against threat intelligence feeds and known malicious publisher lists.

Bottom line: Developer tools are high-value targets for supply chain attacks. Organizations must treat IDE extensions with the same scrutiny as any third-party software deployed to production. Trust, but verify — and never let a sandbox check substitute for continuous behavioral monitoring.

Incident Summary

Incident:	Malicious Solidity Pro VS Code extensions (helper-beeps.solidity-pro, web3devtoolsx.solidity-pro)
Threat Actor:	WhiteCobra-linked cluster (per Yeeth Security analysis)
Affected Systems:	Visual Studio Code, Open VSX, VS Code forks (Cursor, Windsurf, Codium, Positron)
Disclosure Date:	August 10, 2026
Discovery Date:	August 6, 2026 (Yeeth Security)
Exfiltration Method:	Telegram bot upload
Patch Status:	Extensions removed from Open VSX; GitHub repository still active

References

1. Yeeth Security, “Solidity Pro: From WhiteCobra C2 to Telegram Exfiltration,” August 6, 2026, https://yeethsecurity.com/blog/2026-08-06-Solidity-Pro-WhiteCobra-C2-to-Telegram, accessed August 10, 2026.
2. The Hacker News, “Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials,” August 10, 2026, https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html, accessed August 10, 2026.
3. BleepingComputer, “New StormEncryptor ransomware used by former Medusa affiliate,” August 10, 2026, https://www.bleepingcomputer.com/news/security/new-stormencryptor-ransomware-used-by-former-medusa-affiliate/, accessed August 10, 2026.
4. Microsoft Threat Intelligence, Bluesky posts on Storm-1175 and StormEncryptor, August 10, 2026, https://bsky.app/profile/threatintel.microsoft.com/post/3msjiybnb252n, accessed August 10, 2026.
5. Yeeth Security, “WhiteCobra: Malicious VS Code Extensions Distributing Lumma Stealer,” September 3, 2025, https://yeethsecurity.com/blog/2025-09-03-WhiteCobra, accessed August 10, 2026.