Cybersecurity experts have raised alarms about two malicious extensions for Microsoft Visual Studio Code (VS Code), known as Solidity Pro. These extensions, identified as ‘helper-beeps.solidity-pro’ and ‘web3devtoolsx.solidity-pro’, have been implicated in the theft of browser wallets and credentials.
Initial Detection and Methodology
The extensions, though no longer available on the Open VSX marketplace, still have a GitHub repository for ‘web3devtoolsx.solidity-pro’. Research by Yeeth Security revealed that earlier versions of these extensions communicated with Cloudflare Workers endpoints to download and execute an encrypted Python payload.
With the release of version 3.0.0, the extensions evolved into comprehensive information stealers. These malicious tools are now capable of collecting sensitive data such as browser profiles, crypto wallets, source-control tokens, and API keys. The stolen information is then transmitted through a Telegram bot channel.
Data Targeted by the Malware
The array of data targeted by these extensions includes GitHub and GitLab tokens, AWS keys, Cloudflare tokens, and various keys for OpenAI. Additionally, the malware captures mnemonic and seed phrases for multiple crypto wallets including MetaMask, Phantom, and Coinbase. It also targets private keys and credentials stored in URLs, posing a significant threat to user security.
These extensions utilize sophisticated obfuscation techniques to bypass security reviews and scans, which includes deploying intermediate clean versions and implementing delayed activation of malicious code. This allows the malware to remain undetected during initial scans and activate only after a certain period.
Comparative Threat Analysis
The tactics employed by these extensions are reminiscent of those used by WhiteCobra, a threat actor identified in 2025 for distributing the Lumma Stealer via malicious VS Code extensions. This pattern of deploying harmful extensions highlights the ongoing risk posed by such threats in open-source ecosystems.
In a similar vein, another extension flagged this year, ‘ethdevtools.solidity-language-support’, masqueraded as a legitimate tool for Ethereum developers while secretly harboring a clipboard stealer. This malware replaced copied crypto addresses with those controlled by attackers, thereby facilitating unauthorized transactions.
Recommended User Actions
Users who have installed these dangerous extensions are strongly advised to uninstall them immediately. Additional protective measures include reviewing dependency graphs, blocking known command-and-control domains, and monitoring for suspicious activity involving tools like cscript, mshta, cmd, curl, and powershell.
As the cybersecurity landscape evolves, staying vigilant and informed about emerging threats is crucial for safeguarding sensitive data and maintaining secure digital environments.
