Malicious VS Code Extensions Steal Crypto Wallets and Credentials

Cybersecurity researchers at Yeeth Security have flagged two malicious Visual Studio Code extensions posing as Solidity development tools that deliver a full-fledged information stealer targeting browser wallets, source-control tokens, and cloud API keys. The extensions in question, helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, have been removed from Open VSX, though the latter's GitHub repository remains publicly accessible. According to the analysis, versions 1.0.0 through v2.4.x relied on Cloudflare Workers endpoints to beacon out and retrieve an encrypted Python payload, while v3.0.0 onward shifted to a comprehensive credential-stealing payload that exfiltrates captured data through a Telegram bot upload.

The stealer harvests an extensive range of sensitive material, including GitHub ghp_ and github_pat_ tokens, GitLab glpat- tokens, AWS access and session keys, Cloudflare cfat_ tokens, OpenAI sk-, sk-proj-, and sk-ant- keys, Telegram bot tokens, mnemonic and BIP-39 seed phrases, MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr wallet vaults, Bitcoin WIF and xprv keys, SSH private keys, browser URL credentials, and 1Password MFA tokens. To defeat marketplace review and automated static scanners, the operators layered in heavy string obfuscation across IIFE tables, released intermediate clean builds to establish trust, and randomized delayed activation so the malicious branch executes hours or days after install. Users can verify whether their credentials have been exposed by running them through a password checker and reviewing stored tokens across development environments.

This campaign mirrors the tactics of WhiteCobra, a threat cluster uncovered in September 2025 for distributing Lumma Stealer through rogue VS Code extensions, suggesting an evolving playbook targeting Solidity and Web3 developers. Earlier in June 2026, Yeeth Security also flagged "ethdevtools.solidity-language-support," a separate impersonator that hid a clipboard stealer swapping recognized crypto addresses with attacker-controlled ones using the vscode.env.clipboard.writeText API. The recurring use of delayed-activation logic, legitimate-looking intermediate versions, and legitimate first-party VS Code APIs makes this vector particularly difficult to detect without behavioral analysis. Developers who suspect exposure should rotate all API keys, SSH keys, and wallet seeds immediately, audit GitHub and GitLab PATs for unauthorized access, and conduct a broader privacy checkup across their development stack to identify lingering compromise.

The broader lesson is that supply-chain risk now extends far beyond npm and PyPI into the editor-level extension ecosystem, where trust signals like download counts and publisher names can be manufactured. Security teams should pin extension versions, monitor outbound traffic from developer workstations for connections to Cloudflare Workers endpoints, and enforce application allowlists that restrict which extensions can run in production engineering environments.