Malicious VS Code Extensions Disguised as Solidity Tools Are Stealing Crypto Wallets, API Keys and Developer Credentials

Cybersecurity researchers have uncovered a malicious Visual Studio Code extension masquerading as a professional Solidity development tool that has been systematically harvesting cryptocurrency wallets, cloud API keys, SSH private keys, source control tokens and developer credentials from infected systems. The campaign — documented by Yeeth Security — represents a significant escalation in the targeting of Web3 and blockchain developers through their own development environments.

Key Points

• Two malicious VS Code extensions named "Solidity Pro" were identified: helper-beeps.solidity-pro and web3devtoolsx.solidity-pro
• Early versions beaconed to Cloudflare Workers endpoints to retrieve encrypted Python payloads — later versions shifted to a full information stealer
• Stolen data is exfiltrated via Telegram bot upload
• The malware uses randomised delayed activation — running hours or days after installation to evade automated scanners and build user trust first
• The campaign shares tactical overlap with WhiteCobra, a threat cluster detected in September 2025 distributing Lumma Stealer through malicious VS Code extensions
• Neither extension is currently available on Open VSX, but the GitHub repository remains publicly accessible

What the Extensions Do

The two extensions — identified by their publisher and package identifiers as helper-beeps.solidity-pro and web3devtoolsx.solidity-pro — followed an evolutionary attack pattern across their version history.

Early iterations, from version 1.0.0 through v2.4.x, were found to beacon to Cloudflare Workers endpoints and retrieve an encrypted Python payload for execution. From version 3.0.0 onward, the extensions shifted to a fully developed information stealer — a significantly more aggressive capability that targets a comprehensive range of developer credentials and financial assets simultaneously.

The exfiltration mechanism is a Telegram bot upload — a delivery channel that is harder to block than conventional command-and-control server communications because Telegram's infrastructure is widely used for legitimate purposes and blocking it would disrupt far more than the malicious traffic.

What Gets Stolen

The scope of data targeted by the v3.0.0 stealer is unusually broad, covering nearly every category of sensitive credential a Web3 developer is likely to hold.

From source control and cloud infrastructure, the stealer harvests GitHub personal access tokens in both ghp_ and github_pat_ formats, GitLab tokens prefixed with glpat-, AWS access keys and session tokens, and Cloudflare tokens beginning with cfat_. AI development credentials are also targeted — OpenAI API keys in sk-, sk-proj- and sk-ant- formats are explicitly harvested, making this campaign relevant to AI developers as well as blockchain developers.

From cryptocurrency infrastructure, the stealer targets mnemonic seed phrases and recovery phrases, wallet vaults from MetaMask, Phantom, Rabby, Coinbase Wallet, Trust Wallet and Keplr, Bitcoin wallet import format keys and extended private keys. SSH private keys, URL credentials and 1Password multi-factor authentication tokens round out the collection.

Telegram bot tokens are also harvested — giving attackers the ability to impersonate or control any Telegram bots the developer was running, with implications that extend beyond the individual victim to anyone interacting with those bots.

How It Evades Detection

The campaign's most technically significant characteristic is its evasion architecture — a multi-layered approach that defeats the detection mechanisms most extension marketplaces and security tools rely on.

The core technique is randomised delayed activation. The malicious code does not execute immediately upon installation. Instead, it waits hours or days before running its malicious branch — long enough for the user to have concluded the extension is legitimate and useful, and long enough for automated scanners that observe a package for minutes before clearing it to have moved on entirely.

"By the time the malicious branch runs, the user has already decided the extension is useful, and automated scanners that only observe the package for minutes have moved on," Yeeth Security noted.

The obfuscation is not superficial. The malware splits strings across IIFE tables and reassembles them at runtime rather than storing them in a form that static analysis can detect. Method names rotate between releases, meaning signature-based detection must continuously track a moving target rather than matching against a fixed pattern.

Between malicious releases, the operators published intermediate clean versions — functional extensions with no malicious payload — to accumulate positive user signals, build trust scores in the marketplace and reduce the likelihood of takedown before the malicious version was ready for distribution.

The WhiteCobra Connection

Yeeth Security identified tactical overlap between the Solidity Pro campaign and WhiteCobra — a threat cluster first detected in September 2025 that was found distributing Lumma Stealer through malicious VS Code extensions targeting developers using VS Code, Cursor and Windsurf. The two campaigns share the same high-level playbook: malicious VS Code extensions, developer-targeted credential theft, delayed activation and marketplace trust-building through clean intermediate versions.

Whether the same operators are behind both campaigns has not been confirmed, but the shared methodology suggests either direct operational overlap or close familiarity with WhiteCobra's documented techniques.

A Recurring Pattern Against Solidity Developers

The Solidity Pro campaign is not an isolated incident. In June 2026, Yeeth Security flagged a separate extension — ethdevtools.solidity-language-support — that impersonated a Solidity language support tool for Ethereum developers. That extension contained a delayed-activation clipboard stealer specifically designed to scrape BIP-39 seed phrases, Ethereum private keys and wallet addresses. Earlier campaigns in 2025 targeted Russian-speaking developers through bogus Solidity extensions in open-source ecosystems.

The concentration of attacks against Solidity developers is not accidental. Solidity is the primary language for Ethereum smart contract development. Developers working in that space routinely hold private keys, wallet credentials and deployment infrastructure access that represent direct access to significant on-chain value. A single successful infection of a developer with deployment authority over a live protocol can expose far more than the individual's personal holdings.

What Developers Should Do

The Solidity Pro extensions have been removed from Open VSX, but the GitHub repository at web3devtoolsx/solidity-pro remains accessible at the time of writing. Developers who have installed either helper-beeps.solidity-pro or web3devtoolsx.solidity-pro at any version should treat their entire credential set as compromised.

Immediate steps include revoking and rotating all GitHub and GitLab personal access tokens, rotating AWS access keys and session tokens, revoking any Cloudflare API tokens, rotating all OpenAI API keys, revoking Telegram bot tokens, and — critically — moving all cryptocurrency assets to wallets generated from new seed phrases that were never present on the infected machine.

SSH private keys should be rotated and authorised keys files updated across all systems where the compromised keys had access. 1Password MFA tokens that may have been exposed should be reviewed and rotated where possible.

For developers who have not yet installed the extensions, the campaign highlights the importance of treating VS Code extension installations with the same scrutiny applied to any other software deployment. Publisher identity, installation counts, review history and the timing of recent version releases all provide signals worth examining before installing any extension that handles security-sensitive development contexts.

Sources

Yeeth Security blog post on Solidity Pro and WhiteCobra C2 to Telegram, August 6, 2026. The Hacker News reporting on Solidity Pro malicious VS Code extensions, August 2026. Yeeth Security report on ethdevtools clipboard stealer, June 2026. WhiteCobra threat cluster detection, September 2025. The Hacker News weekly recap on VS Code malicious extensions, September 2025.