- Published on
Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
- Authors
- Name
- DeepHorus
Cybersecurity researchers have flagged a malicious Visual Studio Code extension named Solidity Pro that steals crypto wallets, API keys, and credentials. The extension was published as "helper-beeps.solidity-pro" and "web3devtoolsx.solidity-pro." It is no longer available on Open VSX, but its GitHub repository remains active.
Yeeth Security found that early versions (1.0.0β2.4.x) contacted Cloudflare Workers endpoints to retrieve and run an encrypted Python payload. From version 3.0.0 onward, the extension became a full information stealer capable of harvesting browser profiles, crypto wallets, source-control tokens, API keys, SSH keys, and Telegram bot tokens. Stolen data is exfiltrated via Telegram bot uploads.
The stealer targets GitHub ghp_ and GitHub PAT tokens, GitLab glpat- tokens, AWS keys, Cloudflare tokens, OpenAI sk- keys, and Telegram bot tokens. It also collects mnemonic phrases, wallet vaults from MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr, plus Bitcoin WIF/xprv keys. SSH private keys, URL credentials, and 1Password MFA tokens are also captured.
The extension uses heavy obfuscation, intermediate clean builds, and delayed activation to bypass review and sandboxing. "By the time the malicious branch runs, the user has already decided the extension is useful," Yeeth Security said. Obfuscation splits strings across IIFE tables and changes method names each release, hindering signature-based detection.
The firm linked this to WhiteCobra, a group behind Lumma Stealer via malicious VS Code extensions in September 2025. Earlier, in June 2026, Yeeth Security flagged "ethdevtools.solidity-language-support," a clipboard stealer that swapped crypto addresses. Researchers also found additional rogue extensions and npm packages such as "ascii-fetcher" and "DigitalBarberTrim.html-entity-codec."
Users who installed any of the extensions should remove them and inspect for compromise. The findings underscore the growing risk of supply-chain attacks via developer tools. Ongoing monitoring is essential as threat actors continue to refine their methods.
