Malicious VS Code Extensions Target Solidity and Ethereum Developers with Credential Theft
Security firm Yeeth Security uncovered a campaign involving malicious Visual Studio Code (VS Code) extensions, disguised as "Solidity Pro", designed to steal sensitive credentials from Solidity and Ethereum developers. The extensions helper-beeps.solidity-pro and web3devtoolsx.solidity-pro harvested GitHub tokens, cloud credentials, wallet seeds, SSH keys, and other sensitive data, exfiltrating stolen information via a Telegram bot. While the extensions are no longer available on Open VSX, the web3devtoolsx/solidity-pro GitHub repository remains accessible.
Evolution from Loader to Full Credential Stealer
Early versions (1.0.0–2.4.x) functioned as loaders, fetching encrypted Python payloads from Cloudflare Workers. However, version 3.0.0 and later evolved into a full-fledged information stealer, expanding its capabilities to collect:
- Source control tokens (GitHub
ghp_,github_pat_; GitLabglpat-) - Cloud credentials (AWS keys, Cloudflare
cfat_tokens, OpenAI API keys) - Wallet data (MetaMask, Phantom, Rabby, Coinbase, Trust, Keplr vaults; Bitcoin WIF/xprv keys)
- SSH private keys, URL credentials, and 1Password MFA tokens
Evasion Tactics and Delayed Activation
To bypass detection, the extensions employed heavy obfuscation, splitting strings across immediately-invoked function expressions (IIFEs) and reassembling them at runtime. Operators also published clean intermediate versions to build trust before activating malicious behavior hours or days after installation, evading short-term sandboxing and casual review.
Connection to WhiteCobra and Additional Threats
Yeeth linked the campaign to the WhiteCobra cluster, previously associated with Lumma Stealer delivered via VS Code extensions. A related extension, ethdevtools.solidity-language-support, contained a delayed-activation clipboard stealer that swapped cryptocurrency addresses via vscode.env.clipboard.writeText.
Beyond extensions, researchers identified the npm package ascii-fetcher, which concealed malicious code in its dependency @jaymara/jsononifier. This dependency executed hidden commands using child_process.exec with windowsHide, allowing silent execution during installation.
Broader Attack Surface: VS Code Forks and Droppers
Yeeth also reported ten additional rogue VS Code extensions delivering Windows BAT, JavaScript, and HTA droppers. One extension, DigitalBarberTrim.html-entity-codec, dropped a remote VSIX payload after enumerating installed VS Code forks (Cursor, Windsurf, Codium, Positron), tailoring attacks to the specific editor in use.
Impact: Developer Authority and Supply Chain Risks
The stolen credentials grant attackers direct access to repositories, cloud infrastructure, and cryptocurrency wallets, enabling both fund theft and supply-chain compromise. A single compromised developer machine could lead to wider organizational breaches, underscoring the need for provenance checks, allow-list management, and behavioral monitoring in extension supply chains. The campaign highlights persistent risks in developer-targeted attacks, where marketplace moderation alone is insufficient to prevent delayed-activation threats.
Amazon Science cybersecurity rating report: https://www.rankiteo.com/company/amazonscience
Cloudflare cybersecurity rating report: https://www.rankiteo.com/company/cloudflare
npm, Inc. cybersecurity rating report: https://www.rankiteo.com/company/npm-inc-
"id": "AMACLONPM1786444537",
"linkid": "amazonscience, cloudflare, npm-inc-",
"type": "Cyber Attack",
"date": "5/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Blockchain/Software Development',
'location': 'Global',
'name': 'Solidity and Ethereum Developers',
'type': 'Individuals/Organizations'}],
'attack_vector': 'Malicious VS Code Extensions',
'data_breach': {'data_exfiltration': 'Telegram bot',
'personally_identifiable_information': 'GitHub tokens, wallet '
'seeds, SSH keys',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Source control tokens',
'Cloud credentials',
'Wallet data',
'SSH private keys',
'URL credentials',
'1Password MFA tokens']},
'description': 'Security firm Yeeth Security uncovered a campaign involving '
'malicious Visual Studio Code (VS Code) extensions, disguised '
"as 'Solidity Pro', designed to steal sensitive credentials "
'from Solidity and Ethereum developers. The extensions '
'helper-beeps.solidity-pro and web3devtoolsx.solidity-pro '
'harvested GitHub tokens, cloud credentials, wallet seeds, SSH '
'keys, and other sensitive data, exfiltrating stolen '
'information via a Telegram bot.',
'impact': {'brand_reputation_impact': 'Risk to developer trust in VS Code '
'extensions',
'data_compromised': 'GitHub tokens, cloud credentials, wallet '
'seeds, SSH keys, URL credentials, 1Password '
'MFA tokens',
'identity_theft_risk': 'High (PII and credentials stolen)',
'operational_impact': 'Supply-chain compromise, unauthorized '
'access to repositories and cloud '
'infrastructure',
'payment_information_risk': 'High (cryptocurrency wallet seeds and '
'private keys stolen)',
'systems_affected': 'Developer machines, VS Code and its forks '
'(Cursor, Windsurf, Codium, Positron)'},
'initial_access_broker': {'backdoors_established': 'Delayed-activation '
'clipboard stealer, '
'encrypted Python payloads',
'entry_point': 'Malicious VS Code extensions and '
'npm packages',
'high_value_targets': 'Solidity/Ethereum '
'developers, cryptocurrency '
'wallets'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Need for provenance checks, allow-list management, and '
'behavioral monitoring in extension supply chains. '
'Marketplace moderation alone is insufficient to prevent '
'delayed-activation threats.',
'motivation': 'Financial gain, supply-chain compromise',
'post_incident_analysis': {'corrective_actions': 'Remove malicious '
'extensions, audit '
'dependencies, enhance '
'monitoring for suspicious '
'behavior',
'root_causes': 'Lack of strict moderation in VS '
'Code extension marketplaces, '
'delayed activation tactics, '
'obfuscation techniques'},
'recommendations': ['Implement provenance checks for VS Code extensions',
'Use allow-list management for extensions',
'Enhance behavioral monitoring for delayed-activation '
'threats',
'Audit installed extensions and dependencies regularly'],
'references': [{'source': 'Yeeth Security'}],
'response': {'containment_measures': 'Extensions removed from Open VSX',
'enhanced_monitoring': 'Behavioral monitoring recommended',
'third_party_assistance': 'Yeeth Security'},
'threat_actor': 'WhiteCobra cluster',
'title': 'Malicious VS Code Extensions Target Solidity and Ethereum '
'Developers with Credential Theft',
'type': 'Credential Theft',
'vulnerability_exploited': 'Delayed activation and obfuscation in VS Code '
'extensions'}