Malicious VS Code Extension "Solidity Pro" Steals Crypto Wallets and Credentials

Malicious Extension Identified

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro ("solidity-pro"), specifically versions "helper-beeps.solidity-pro" and "web3devtoolsx.solidity-pro". These extensions have been observed delivering a browser wallet and credential stealer.

Evolution of the Threat

Early iterations of the extensions (v1.0.0 through v2.4.x) beaconed to Cloudflare Workers endpoints to retrieve and execute an encrypted Python payload. Subsequent versions, starting with v3.0.0, evolved into a full-blown information stealer capable of collecting browser profiles, crypto wallets, source-control tokens, API keys, SSH keys, and Telegram bot tokens. The stolen data is then exfiltrated via a Telegram bot upload.

Data Compromised

The malware harvests a wide range of sensitive data, including GitHub, GitLab, AWS, Cloudflare, and OpenAI tokens/keys. It also targets Telegram bot tokens, mnemonic and seed phrases, various cryptocurrency wallet vaults (MetaMask, Phantom, Rabby, Coinbase, Trust, Keplr), Bitcoin WIF/xprv, SSH private keys, URL credentials, and 1Password MFA tokens.

Evasion Techniques

The malicious extension employs sophisticated techniques to bypass marketplace review, static scanning, and casual sandboxing. These include heavy obfuscation, the release of intermediate clean versions to build trust, and randomized delayed activation. This delayed activation causes the malicious code to run several hours or days after installation, making it difficult for automated scanners to detect the threat.

Broader Context

This incident is not isolated, as threat actors have previously published bogus Solidity extensions across open-source ecosystems. The activity shares similarities with the WhiteCobra threat cluster, which was detected distributing Lumma Stealer through malicious VS Code extensions.