Full Report
Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro ("solidity-pro") that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-pro Although neither of the extensions is now available on Open VSX, the GitHub repository
Analysis Summary
# Tool/Technique: Solidity Pro Malicious VS Code Extension
## Overview
Solidity Pro is a malicious Microsoft Visual Studio Code (VS Code) extension designed to target blockchain developers. It functions as a sophisticated information stealer and credential harvester, masquerading as a legitimate development tool for the Solidity programming language.
## Technical Details
- **Type:** Malware (Information Stealer / Credential Stealer)
- **Platform:** Windows, macOS, Linux (Cross-platform via VS Code/Node.js)
- **Capabilities:** Credential harvesting, crypto wallet draining, clipboard manipulation, and anti-analysis.
- **First Seen:** Early iterations identified in 2025/2026; flagged by researchers in August 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.002 - Supply Chain Compromise: Compromise Software Dependencies]
- **[TA0002 - Execution]**
- [T1059.003 - Command and Scripting Interpreter: Windows Command Shell]
- [T1204.002 - User Execution: Malicious File]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion]
- **[TA0006 - Credential Access]**
- [T1555 - Credentials from Web Browsers]
- [T1552.004 - Unsecured Credentials: Private Keys]
- **[TA0009 - Collection]**
- [T1115 - Clipboard Data]
- **[TA0010 - Exfiltration]**
- [T1567.002 - Exfiltration Over Web Service: Exfiltration to Code Repository]
## Functionality
### Core Capabilities
- **Credential Harvesting:** Steals AWS keys, session tokens, Cloudflare tokens, OpenAI API keys, and GitLab/GitHub Personal Access Tokens (PATs).
- **Crypto Wallet Theft:** Targets Mnemonic phrases, seed phrases, and vault files from MetaMask, Phantom, Rabby, Coinbase, Keplr, and Trust Wallet.
- **SSH/Private Key Extraction:** Scans for and exfiltrates files containing `PRIVATE KEY` strings and Bitcoin WIF/xprv data.
- **Browser Profile Collection:** Extracts stored credentials and MFA tokens from browser profiles (including 1Password).
### Advanced Features
- **Delayed Activation:** Implements a randomized delay (hours or days) before executing malicious logic to bypass sandbox environments and build user trust.
- **Heavy Obfuscation:** Uses Immediately Invoked Function Expressions (IIFE) and runtime string reassembly to defeat static analysis and signature-based detection.
- **Clipboard Hijacking:** Monitors the clipboard for crypto addresses and replaces them with attacker-controlled addresses using the `vscode.env.clipboard.writeText` API.
- **Stealth Updates:** Distributes "clean" versions of the tool to maintain a presence on marketplaces before pushing malicious updates.
## Indicators of Compromise
- **File Names:**
- `helper-beeps.solidity-pro`
- `web3devtoolsx.solidity-pro`
- `ethdevtools.solidity-language-support`
- **Network Indicators:**
- `https[:]//api[.]telegram[.]org` (Exfiltration)
- Cloudflare Workers endpoints (Payload retrieval - specific URLs vary)
- **Behavioral Indicators:**
- VS Code process initiating unusual network connections to Telegram APIs.
- Unexpected file read operations on `~/.ssh/`, `~/.aws/credentials`, or browser local storage directories.
## Associated Threat Actors
- **WhiteCobra:** Linked to this activity due to overlapping TTPs and shared history of distributing Lumma Stealer via VS Code extensions.
## Detection Methods
- **Behavioral Detection:** Monitor for VS Code (Code.exe) calling `child_process.exec` to run unauthorized scripts or accessing sensitive files like SSH keys.
- **Network Monitoring:** Alert on outbound traffic from IDE processes to known C2 infrastructure or unusual API endpoints (e.g., Telegram bots).
- **Extension Auditing:** Regularly audit installed extensions for high-risk permissions and check publisher reputation against known malicious lists.
## Mitigation Strategies
- **Marketplace Hygiene:** Only install extensions from verified publishers with a high number of installs and long-standing reputations.
- **Principle of Least Privilege:** Avoid running IDEs with administrative privileges; use environment variables to restrict access to sensitive file paths.
- **Secret Management:** Use dedicated secret management tools (e.g., HashiCorp Vault) rather than storing API keys or SSH keys in plaintext files on the developer's workstation.
- **Static Analysis:** Employ tools that can scan VSIX files for obfuscated JavaScript or unauthorized API calls before deployment in corporate environments.
## Related Tools/Techniques
- **Lumma Stealer:** Often distributed via similar supply chain attacks.
- **SleepyDuck:** Another malicious VS Code extension family.
- **Clipboard Swapping:** A technique common in crypto-stealing malware to redirect financial transactions.