News › security
By Zayden R., August 10, 2026
Cybersecurity researchers have flagged malicious VS Code extensions named Solidity Pro that steal crypto wallets and credentials. The extensions, though removed from Open VSX, still pose a threat via GitHub.
Cybersecurity researchers have identified malicious Microsoft Visual Studio Code extensions named Solidity Pro that have been stealing crypto wallets, API keys, and various credentials. This alarming discovery is crucial for engineers and developers who rely on VS Code for secure software development.
The extensions, 'helper-beeps.solidity-pro' and 'web3devtoolsx.solidity-pro,' have been removed from Open VSX. However, the GitHub repository 'web3devtoolsx/solidity-pro' remains accessible, posing a continued threat. According to Yeeth Security, early versions, 1.0.0 through v2.4.x, used Cloudflare Workers endpoints to retrieve an encrypted Python payload. From version 3.0.0 onward, these extensions evolved into full-blown information stealers.
The malware targets an array of sensitive data, including GitHub and GitLab tokens, AWS keys, Cloudflare tokens, OpenAI keys, Telegram bot tokens, and numerous crypto wallet vaults such as MetaMask and Coinbase. Even SSH private keys and URL credentials are not spared. The stolen data is exfiltrated via a Telegram bot, making it imperative for users to scrutinize their extension lists for any signs of these malicious tools.
What makes these extensions particularly dangerous is their ability to bypass marketplace reviews and static scanning. Through heavy obfuscation and randomized delayed activation, they avoid detection by automated scanners. By the time the malicious code activates, users often trust the extensions as legitimate.
This modus operandi shares similarities with WhiteCobra, a threat cluster identified in September 2025 that distributed Lumma Stealer via malicious VS Code extensions. The parallels underscore the need for heightened vigilance among developers using open-source extensions.
Engineers should immediately check their VS Code installations for these extensions and remove them if found. Updating security protocols and monitoring network traffic for unusual activity can also mitigate potential threats.
The Linux Camp teaches these topics as hands-on labs on real virtual machines, verified as you type.