Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Ravie LakshmananAug 10, 2026Malware / Cybercrime

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro ("solidity-pro") that has been observed delivering a browser wallet and credential stealer.

The names of the extensions are below -

• helper-beeps.solidity-pro
• web3devtoolsx.solidity-pro

Although neither of the extensions is now available on Open VSX, the GitHub repository for "web3devtoolsx/solidity-pro" continues to remain accessible as of writing.

According to Yeeth Security, early iterations of the extensions – from 1.0.0 through v2.4.x – were found to beacon to Cloudflare Workers endpoints to retrieve an encrypted Python payload and execute it.

Subsequent versions starting with v3.0.0, on the other hand, have shifted to a full-blown information stealer that can collect browser profiles, crypto wallets, source-control tokens, API keys, SSH keys, and Telegram bot tokens. The captured data is then exfiltrated via a Telegram bot upload.

The list of data harvested by the stealer is as follows -

• GitHub ghp_ and github_pat_ tokens
• GitLab glpat- tokens
• AWS keys and session tokens
• Cloudflare cfat_ tokens
• OpenAI sk-, sk-proj-, and sk-ant- keys
• Telegram bot tokens
• Mnemonic and seed phrases
• MetaMask, Phantom, Rabby, Coinbase, Trust, Keplr wallet vaults
• Bitcoin WIF / xprv
• SSH private keys (PRIVATE KEY)
• URL credentials and 1Password MFA tokens