Fast Facts
- Malicious VS Code extensions, such as "solidity-pro," deliver a full-scale info stealer that exfiltrates sensitive data like crypto wallets, API keys, and SSH keys via Telegram, evading detection through obfuscation and delayed activation.
- These extensions dynamically switch from retrieving encrypted payloads to directly stealing user credentials, using techniques like string splitting, runtime reassembly, and injection, bypassing static and sandbox defenses.
- The activity is linked to broader campaigns involving rogue npm packages and dropper extensions that execute remote code, malware, or system commands, posing high risks to developers’ and users’ environments.
Threat Overview, Attack Techniques, and Targets
Cybersecurity researchers warn about a malicious Visual Studio Code (VS Code) extension called Solidity Pro. This extension includes two versions: “helper-beeps.solidity-pro” and “web3devtoolsx.solidity-pro.” Although they are not currently listed on the Open VSX marketplace, the GitHub repository for “web3devtoolsx/solidity-pro” is still accessible.
Initial versions (from 1.0.0 to 2.4.x) of the extension reached out to Cloudflare Workers endpoints. They retrieved an encrypted Python payload and executed it on the victim’s system. Later versions, starting with v3.0.0, shifted to a more dangerous approach. They act as information stealers that collect data such as browser profiles, crypto wallets, API keys, and credentials. This data is then sent using Telegram bots.
The extension targets developers and users who install VS Code extensions. It specifically aims to steal crypto wallets and sensitive credentials, including API tokens, SSH keys, and seed phrases. It can also access wallet vaults and private keys related to cryptocurrencies.
Impact, Security Implications, and Remediation Guidance
The malicious extension poses serious security risks. It can steal private financial information and access user accounts. The malware uses obfuscation techniques to avoid detection. It can also activate its payload days after installation, making it harder to identify early.
Because the extension steals sensitive data, victims may face financial loss, identity theft, or unauthorized account access. The malware’s ability to bypass static scanning and some sandboxing measures makes it difficult to detect without deeper analysis.
If you suspect infection, users should remove the malicious extension immediately. You should also inspect dependency graphs for related malware. It is important to block known command-and-control domains and monitor for suspicious commands such as cscript, mshta, cmd, curl, and PowerShell.
For further guidance on removing this malware or protecting your environment, consult the relevant vendor or authority.
Continue Your Tech Journey
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
