Fake Solidity Extensions Steal Crypto Wallets

The developer ecosystem is once again under siege, this time through a pair of malicious Visual Studio Code extensions that masquerade as legitimate Solidity development tools. Security researchers at Yeeth Security have uncovered a campaign, centered on extensions named "Solidity Pro," that delivers a sophisticated credential and crypto-wallet stealer, targeting developers and their digital assets.

Malicious Extension Duo Uncovered

Yeeth Security flagged two extensions under the names helper-beeps.solidity-pro and web3devtoolsx.solidity-pro. While neither is currently available on Open VSX, the GitHub repository for the latter remains accessible, according to the researchers.

The campaign's evolution is notable. Early versions, from 1.0.0 through v2.4.x, were found to beacon to Cloudflare Workers endpoints, fetching an encrypted Python payload for execution. This initial phase primarily focused on establishing a foothold.

Shift to Full Information Stealer

Starting with version 3.0.0, the extensions transformed into a full-blown information stealer, designed to harvest a wide array of sensitive data. This includes browser profiles, crypto wallet vaults, source-control tokens, API keys, SSH keys, and even Telegram bot tokens. Captured data is exfiltrated via a Telegram bot upload, providing attackers with a simple and effective communication channel.

Extensive Data Harvesting Capabilities

The stealer targets a broad spectrum of credentials and keys, including:

• GitHub tokens: ghp_ and github_pat_
• GitLab tokens: glpat-
• AWS keys and session tokens
• Cloudflare tokens: cfat_
• OpenAI keys: sk-, sk-proj-, and sk-ant-
• Telegram bot tokens
• Mnemonic and seed phrases
• Wallet vaults from MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr
• Bitcoin WIF and xprv keys
• SSH private keys
• URL credentials and 1Password MFA tokens

This wide net underscores the attackers' intent to compromise both financial assets and broader developer infrastructure.

Evasion Tactics and Delayed Activation

The malware family is engineered to bypass marketplace review and static scanning through heavy obfuscation and randomized delayed activation. Malicious code runs hours or even days after installation, allowing the extension to appear benign initially.

"By the time the malicious branch runs, the user has already decided the extension is useful, and automated scanners that only observe the package for minutes have moved on," Yeeth Security said. "The obfuscation is not decorative; it splits strings across IIFE tables, reassembles them at runtime, and switches method names between releases so signature-based detection must track a moving target."

Parallels to Previous Threats

Yeeth Security notes that this activity shares a playbook with WhiteCobra, a threat cluster detected in September 2025 distributing Lumma Stealer through malicious VS Code extensions. This is not an isolated incident; in June 2026, the same firm flagged "ethdevtools.solidity-language-support," a fake Solidity language-support tool that harbored a delayed-activation clipboard stealer.

That stealer targeted BIP-39 seed phrases, Ethereum private keys, and wallet addresses. "When a recognized crypto address is on the clipboard, it replaces the pasted value with an attacker-controlled address," the researchers added. "The swap happens through vscode.env.clipboard.writeText, a first-party API call that requires no child_process, no network access, and no file writes. Static scanners that only look for dangerous Node imports will not see it."

Broader Supply Chain Concerns

The findings coincide with the discovery of various other rogue VS Code extensions and npm packages. These include:

• An npm package named "ascii-fetcher" embedding malicious code in a dependency called "@jaymara/jsononifier" to decode and execute commands via child_process.exec.
• A set of 10 VS Code extensions delivering Windows-based BAT, JavaScript, and HTA droppers, with two bundling a npm dependency that uses a postinstall hook to fetch and execute a remote payload.
• An extension named "DigitalBarberTrim.html-entity-codec" that drops a remote VSIX file after enumerating known VS Code forks like Cursor, Windsurf, Codium, and Positron.
• An extension named "Zlmiles.zlmiles-liquid," now removed from the VS Marketplace, which uses a suspected builder kit to drop an MSI installer hosted on a Replit domain.

Recommended Mitigations

Users who have installed affected extensions are advised to remove them immediately. Additionally, they should inspect dependency graphs, block known command-and-control (C2) domains, and alert on the use of cscript, mshta, cmd, curl, and powershell commands.

This campaign highlights the growing risk in the open-source ecosystem. As developers increasingly rely on community-built tools, the potential for supply-chain attacks continues to expand, making vigilance and proactive security measures essential.