Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
A malicious Microsoft Visual Studio Code extension named Solidity Pro has been identified as a sophisticated information stealer, capable of harvesting a wide range of sensitive data from users’ systems, including crypto wallets, API keys, and SSH keys. The malware employs advanced obfuscation techniques to evade detection and has been linked to previous campaigns utilizing similar tactics.
Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension, "Solidity Pro" (solidity-pro), that has been used to deliver a browser wallet and credential stealer. The extensions, "helper-beeps.solidity-pro" and "web3devtoolsx.solidity-pro", are no longer available on Open VSX, but their GitHub repository remains accessible. Early versions of the extensions communicated with Cloudflare Workers to retrieve an encrypted Python payload and execute it, while later versions evolved into a full-blown information stealer.
This stealer can collect a vast amount of data, including GitHub tokens, GitLab tokens, AWS keys, Cloudflare tokens, OpenAI keys, Telegram bot tokens, mnemonic phrases, seed phrases, and wallet vaults from popular crypto wallets like MetaMask, Phantom, and Trust. It also targets SSH private keys and URL credentials, including 1Password MFA tokens. The malware utilizes heavy obfuscation, intermediate clean versions, and randomized delayed activation to bypass marketplace review, static scanning, and casual sandboxing.
The activity shares similarities with WhiteCobra, a threat cluster detected in September 2025 distributing Lumma Stealer through malicious VS Code extensions. Previous research in June 2026 identified another bogus Solidity extension, "ethdevtools.solidity-language-support," which also employed a delayed-activation clipboard stealer to steal BIP-39 seed phrases and Ethereum private keys. The stealer operates by replacing pasted values with attacker-controlled addresses through a first-party API call that requires no network access or file writes, making it difficult to detect with traditional static scanners.
Beyond the Solidity Pro extensions, researchers have also uncovered a number of other malicious VS Code extensions and npm packages, including an npm package called "ascii-fetcher" that embeds malicious code in a dependency to execute a remote payload, and a set of VS Code extensions that deliver droppers for Windows-based BAT, JavaScript, and HTA files, some bundling npm dependencies that use postinstall hooks to fetch and execute remote payloads. Users are advised to remove the extensions, inspect dependency graphs, block known command-and-control (C2) domains, and alert on the use of cscript, mshta, cmd, curl, and powershell commands.