Malicious Solidity Pro Extension Steals Crypto Wallets
VS Code extension hijacks users' API keys and credentials.
1Malicious Extension Detected
Yeeth Security identified a malicious VS Code extension named Solidity Pro. The extension steals browser wallets, API keys, and credentials. The extension is no longer available on Open VSX, but its GitHub repository remains accessible. Such threats are becoming increasingly common in open-source ecosystems.
2Extension's Mechanism
The extension's early versions retrieved an encrypted Python payload via Cloudflare Workers and executed it. Starting with v3.0.0, it transformed into a full-blown information stealer, collecting browser profiles, crypto wallets, API keys, and SSH keys, exfiltrating data via a Telegram bot.
3Bypassing Security Measures
The extension bypasses marketplace reviews, static scans, and sandbox environments using heavy obfuscation techniques. It builds trust with clean intermediate versions and activates malicious code hours or days after installation, making it difficult for automated scanners to detect the threat.
4Similar Threats
This activity shares similarities with the WhiteCobra threat cluster detected in September 2025. WhiteCobra distributed Lumma Stealer through malicious VS Code extensions. Such threats are becoming more frequent in open-source ecosystems.
5Past Similar Incidents
In June 2026, Yeeth Security flagged another extension masquerading as Solidity language support for Ethereum developers. This extension contained a delayed-activation clipboard stealer that scraped BIP-39 seed phrases, Ethereum private keys, and wallet addresses.
6Clipboard Manipulation
When a recognized crypto address is copied to the clipboard, the extension replaces it with an attacker-controlled address. This operation is performed using the vscode.env.clipboard.writeText API call, which static scanners looking for dangerous Node imports cannot detect.
7User Precautions
Users who installed the extension are advised to remove it immediately, inspect dependency graphs, and block known command-and-control (C2) domains. Additionally, they should monitor the use of cscript, mshta, cmd, curl, and powershell commands.
8Open Source Risks
This incident highlights the risks in open-source ecosystems once again. Organizations need to be more proactive in managing AI-driven open-source risks, reducing remediation debt, and developing scalable governance strategies.
Original article: The Hacker News — Kötü Amaçlı Solidity Pro Eklentisi Kripto Cüzdanları Çalıyor