Cybersecurity researchers have flagged a malicious **Microsoft Visual Studio Code (VS Code)** extension named **Solidity Pro** (**"solidity-pro"**) that has been observed delivering a browser wallet and credential stealer. Specifically, the extensions identified are: * **helper-beeps.solidity-pro** * **web3devtoolsx.solidity-pro** While neither extension is currently available on Open VSX, the GitHub repository for "web3devtoolsx/solidity-pro" remains accessible as of writing. According to **Yeeth Security**, early iterations of the extensions (v1.0.0 through v2.4.x) were found to beacon to **Cloudflare Workers** endpoints to retrieve and execute an encrypted Python payload. ### Evolution to a Full-Blown Info Stealer Subsequent versions, starting with v3.0.0, evolved into a full-blown information stealer. This advanced variant is capable of collecting a wide array of sensitive data, including browser profiles, cryptocurrency wallets, source-control tokens, API keys, SSH keys, and Telegram bot tokens. The captured data is then exfiltrated via a Telegram bot upload. The extensive list of harvested data includes: * **GitHub** ghp_ and github_pat_ tokens * **GitLab** glpat- tokens * **AWS** keys and session tokens * **Cloudflare** cfat_ tokens * **OpenAI** sk-, sk-proj-, and sk-ant- keys * Telegram bot tokens * Mnemonic and seed phrases * **MetaMask**, **Phantom**, **Rabby**, **Coinbase**, **Trust**, **Keplr** wallet vaults * **Bitcoin** WIF / xprv * SSH private keys (PRIVATE KEY) * URL credentials and **1Password** MFA tokens ### Evasion Techniques The malware family employs sophisticated techniques to bypass marketplace reviews, static scanning, and casual sandboxing. These include heavy obfuscation, the release of intermediate clean versions to build trust, and randomized delayed activation. This delayed activation causes the malicious code to run several hours or even days after installation. "By the time the malicious branch runs, the user has already decided the extension is useful, and automated scanners that only observe the package for minutes have moved on," **Yeeth Security** highlighted. "The obfuscation is not decorative; it splits strings across IIFE tables, reassembles them at runtime, and switches method names between releases so signature-based detection must track a moving target." ### Connection to WhiteCobra and Other Campaigns **Yeeth Security** noted that this activity shares a similar high-level playbook with **WhiteCobra**, another threat cluster identified in September 2025 for distributing **Lumma Stealer** through malicious **VS Code** extensions. This isn't an isolated incident. Threat actors have previously published bogus **Solidity** extensions across open-source ecosystems. In June 2026, **Yeeth Security** flagged another extension, **"ethdevtools.solidity-language-support,"** which impersonated a **Solidity** language-support tool but harbored a delayed-activation clipboard stealer. This stealer was designed to scrape BIP-39 seed phrases, **Ethereum** private keys, and wallet addresses. "When a recognized crypto address is on the clipboard, it replaces the pasted value with an attacker-controlled address," the report added. "The swap happens through `vscode.env.clipboard.writeText`, a first-party API call that requires no `child_process`, no network access, and no file writes. Static scanners that only look for dangerous Node imports will not see it." ### Other Rogue Extensions and Packages Discovered The findings coincide with the discovery of several other rogue **VS Code** extensions and **npm** packages: * An **npm** package called **"ascii-fetcher"**, which embeds malicious code in a dependency named **"@jaymara/jsononifier"** to decode an embedded command (e.g., "calc.exe") and run it via **"child_process.exec"** with **"windowsHide"**. * A set of 10 **VS Code** extensions that deliver various Windows-based BAT, JavaScript, and HTA droppers. Two of these bundled an **npm** dependency using a postinstall hook to fetch and execute a remote payload. * A **VS Code** extension named **"DigitalBarberTrim.html-entity-codec"** that drops a remote VSIX file in select versions after enumerating known **VS Code** forks like **Cursor**, **Windsurf**, **Codium**, and **Positron**, while serving a "nearly empty stub" in others to avoid detection. * A **VS Code** extension named **"Zlmiles.zlmiles-liquid"** (now removed from the VS Marketplace) that utilized a suspected builder kit to drop an MSI installer hosted on a **Replit** domain. ### Recommendations for Users Users who have installed these or similar extensions are strongly advised to remove them immediately. Furthermore, it is critical to inspect dependency graphs, block known command-and-control (C2) domains, and configure alerts for the use of `cscript`, `mshta`, `cmd`, `curl`, and `powershell` commands.