Cybersecurity researchers have identified a harmful Microsoft Visual Studio Code extension called Solidity Pro that delivers a browser wallet and credential thief targeting developers. According to Yeeth Security, the malicious tools operated under two package names—"helper-beeps.solidity-pro" and "web3devtoolsx.solidity-pro"—and while both have been removed from Open VSX, the GitHub repository for one variant remains online. Early versions of the extensions sent requests to Cloudflare Workers endpoints to pull down an encrypted Python payload and run it, but later releases shifted to a comprehensive information stealer.
The malware harvests a wide range of sensitive developer data, including GitHub and GitLab tokens, AWS keys and session tokens, Cloudflare and OpenAI API keys, Telegram bot tokens, mnemonic and seed phrases, wallet vaults from MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr, Bitcoin private keys, SSH private keys, URL credentials, and 1Password multi-factor authentication tokens. Versions starting with v3.0.0 contain the full-fledged stealer capability, exfiltrating captured information through a Telegram bot upload. The extensions also employ heavy obfuscation, intermediate clean versions to establish trust, and randomized delayed activation that triggers malicious code hours or days after installation to evade marketplace review, static scanning, and casual sandboxing.
Yeeth Security notes that "by the time the malicious branch runs, the user has already decided the extension is useful, and automated scanners that only observe the package for minutes have moved on." The research firm adds that "the obfuscation is not decorative; it splits strings across IIFE tables, reassembles them at runtime, and switches method names between releases so signature-based detection must track a moving target." The security company said the activity follows the same high-level playbook as WhiteCobra, another threat cluster detected in September 2025 that distributed Lumma Stealer through malicious VS Code extensions. In June 2026, Yeeth Security flagged a separate extension named "ethdevtools.solidity-language-support" that impersonated a Solidity language-support tool but contained a delayed-activation clipboard stealer to scrape seed phrases, Ethereum private keys, and wallet addresses.
The findings reveal how threat actors exploit developer trust in open-source ecosystems by publishing bogus extensions that appear legitimate before activating hidden payloads. The report explains that when a recognized crypto address appears on the clipboard, the malware replaces the pasted value with an attacker-controlled address through the first-party API call "vscode.env.clipboard.writeText," which requires no child process, network access, or file writes, making it invisible to static scanners that only look for dangerous Node imports. The research also coincides with the discovery of additional rogue VS Code extensions and npm packages, including an npm package called "ascii-fetcher" that embeds malicious code in a dependency to decode and execute commands, a set of 10 VS Code extensions delivering Windows-based droppers, and an extension named "DigitalBarberTrim.html-entity-codec" that drops a remote VSIX file after enumerating known VS Code forks like Cursor, Windsurf, Codium, and Positron while serving a nearly empty stub in other environments to avoid detection.
Users who installed the extensions should remove them immediately, inspect dependency graphs, block known command-and-control domains, and monitor for use of cscript, mshta, cmd, curl, and powershell commands. The malware's ability to bypass automated security checks through delayed activation and API-level operations that leave no traditional forensic traces highlights a significant blind spot in current extension vetting processes. Developer toolchains have become high-value targets precisely because they sit at the intersection of privileged access and routine trust, turning everyday workflow automation into a vector for systematic credential harvesting.