Malicious Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
Cybersecurity researchers have uncovered a series of malicious extensions for Microsoft Visual Studio Code (VS Code), primarily under the name “Solidity Pro” (“solidity-pro”), designed to exfiltrate sensitive data including cryptocurrency wallets, API keys, and various credentials. Although the extensions are no longer available on Open VSX marketplaces, their associated GitHub repository remains accessible, posing an ongoing risk to users who may have previously installed them. This activity highlights the persistent threat of supply chain attacks targeting developer tools.
Evolution and Functionality of Malicious Solidity Pro VS Code Extensions
Initial versions of the “Solidity Pro” extension, specifically from 1.0.0 through v2.4.x, functioned by beaconing to Cloudflare Workers endpoints. This communication mechanism was used to retrieve and execute an encrypted Python payload on the victim’s system. According to Yeeth Security, subsequent versions, starting with v3.0.0, evolved into a full-fledged information stealer. This advanced variant is capable of collecting a wide array of sensitive data, including:
- Browser profiles
- Cryptocurrency wallets
- Source-control tokens
- API keys
- SSH keys
- Telegram bot tokens
The stolen data is then exfiltrated via an upload to a Telegram bot, providing attackers with immediate access to compromised information. This sophisticated approach demonstrates how Solidity Pro VS Code extensions steal crypto wallets and other critical data from unsuspecting developers.
Evasion Techniques and Related Threat Clusters
A key characteristic of these malicious extensions is their sophisticated evasion tactics. The malware family incorporates heavy obfuscation, employs intermediate “clean” versions to build trust with users and automated scanners, and utilizes randomized delayed activation. This delayed activation mechanism allows the malicious code to run several hours or even days after installation, effectively bypassing marketplace review, static scanning, and casual sandboxing. Yeeth Security notes that by the time the malicious branch executes, users often already consider the extension useful, and automated scanners have moved on. The obfuscation itself is advanced, splitting strings across IIFE tables, reassembling them at runtime, and frequently changing method names across releases to create a moving target for signature-based detection.
This activity bears similarities to the WhiteCobra threat cluster, identified in September 2025, which also leveraged malicious VS Code extensions to distribute the Lumma Stealer. Furthermore, this is not an isolated incident concerning bogus Solidity extensions. In June 2026, Yeeth Security flagged another extension, “ethdevtools.solidity-language-support,” which impersonated a legitimate Solidity language-support tool for Ethereum developers. This particular extension harbored a delayed-activation clipboard stealer designed to scrape BIP-39 seed phrases, Ethereum private keys, and wallet addresses. The clipboard stealer operates by replacing a recognized crypto address on the clipboard with an attacker-controlled address via vscode.env.clipboard.writeText, a first-party API call requiring no child_process, network access, or file writes, thus easily evading static scanners looking for dangerous Node imports.
Identifying Compromise from Malicious Solidity Pro Extensions and Mitigation Strategies
Given the stealthy nature and delayed activation mechanisms, identifying compromise from malicious Solidity Pro extensions requires vigilance beyond initial installation. Security professionals must assume compromise if these extensions were ever installed.
Recommended Actions:
- Immediate Removal: Users who have installed “Solidity Pro” (“solidity-pro”) or “ethdevtools.solidity-language-support” extensions should remove them immediately from their VS Code environments.
- System Inspection: Conduct a thorough inspection of affected systems for any signs of data exfiltration or residual malicious activity. This includes reviewing browser profiles, crypto wallet files, and developer-related tokens (source-control, API, SSH, Telegram).
- Dependency Graph Analysis: Inspect dependency graphs of projects to identify any lingering malicious components or unexpected inclusions that might have been introduced by the extensions.
- Command-and-Control (C2) Blocking: Block known command-and-control (C2) domains associated with these extensions. While specific C2s are not detailed in the source, threat intelligence feeds should be consulted.
- Behavioral Monitoring: Enhance monitoring for unusual process execution, specifically alerting on the use of
cscript,mshta,cmd,curl, andpowershellcommands, which can indicate post-exploitation activity or payload execution. - Credential Rotation: Rotate all potentially compromised credentials, including API keys, SSH keys, source-control tokens, and crypto wallet seed phrases/private keys.
- Education and Vigilance: Emphasize the importance of verifying the authenticity and reputation of VS Code extensions before installation. Adhere to the principle of least privilege for developer environments.
Mitigation strategies for VS Code extension supply chain attacks must focus on a layered security approach. This includes strong endpoint detection and response (EDR) solutions, network egress filtering to detect unusual C2 communications, and regular security awareness training for developers regarding the risks of untrusted extensions and packages.
Related: VS Code Marketplace Abuse: Detecting Malicious Developer Extensions, GitHub Repository Breach: 3,800 Repos Accessed via VS Code Extension