Cybersecurity researchers have identified malicious Visual Studio Code (VS Code) extensions named ‘Solidity Pro’ that are designed to steal sensitive information from developers. These extensions, previously available under the names ‘helper-beeps.solidity-pro’ and ‘web3devtoolsx.solidity-pro,’ have been removed from the Open VSX registry. However, the GitHub repository for ‘web3devtoolsx/solidity-pro’ remains accessible.
Initial versions of these extensions (v1.0.0 through v2.4.x) contacted Cloudflare Workers endpoints to retrieve and execute encrypted Python payloads. Starting with v3.0.0, the extensions evolved into comprehensive information stealers capable of collecting browser profiles, cryptocurrency wallets, source-control tokens, API keys, SSH keys, and Telegram bot tokens. The stolen data is exfiltrated via a Telegram bot.
The specific data targeted includes:
- GitHub tokens (ghp_ and github_pat_)
- GitLab tokens (glpat-)
- AWS keys and session tokens
- Cloudflare tokens (cfat_)
- OpenAI keys (sk-, sk-proj-, sk-ant-)
- Telegram bot tokens
- Mnemonic and seed phrases
- Vaults from MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr wallets
- Bitcoin WIF/xprv
- SSH private keys
- URL credentials and 1Password MFA tokens
These extensions employ advanced obfuscation techniques to evade detection, including splitting strings across immediately invoked function expression (IIFE) tables and reassembling them at runtime. They also introduce clean versions to build trust before activating malicious code after several hours or days, making detection by automated scanners challenging.
This campaign shares similarities with previous attacks, such as the ‘WhiteCobra’ threat cluster detected in September 2025, which distributed Lumma Stealer through malicious VS Code extensions. Additionally, in June 2026, another extension named ‘ethdevtools.solidity-language-support’ impersonated a Solidity language-support tool but contained a delayed-activation clipboard stealer targeting BIP-39 seed phrases, Ethereum private keys, and wallet addresses.
These incidents underscore the persistent threats within open-source ecosystems, particularly targeting developers in the cryptocurrency space. The use of delayed-activation techniques and sophisticated obfuscation highlights the need for heightened vigilance. Developers should exercise caution when installing extensions, especially those related to cryptocurrency development, and regularly review and audit their tools to mitigate potential risks.
