Fake Solidity Pro editor extensions steal crypto wallets and developer keys

Researchers at Yeeth Security flagged malicious Visual Studio Code extensions named Solidity Pro that pose as tools for blockchain developers while stealing wallets and credentials. Early versions quietly fetched an encrypted payload from cloud infrastructure after a delay of up to three days and ran it outside the editor to evade quick checks. Later versions became full information stealers, collecting browser profiles, cryptocurrency wallets and seed phrases, source-control tokens, cloud credentials, API keys, and SSH private keys, then sending them out through a Telegram bot. The extensions were pulled from the Open VSX marketplace, but the project's code repository remained available.

Check

Check developer machines for the Solidity Pro extension and remove it, and rotate wallets, source-control tokens, cloud credentials, API keys, and SSH keys if it was installed.

Affected

Blockchain and other developers who installed a Solidity Pro extension; running with the developer's access, it steals cryptocurrency wallets, seed phrases, and source-control, cloud, and infrastructure credentials, exfiltrating them over Telegram.

Fix

Install editor extensions only from trusted publishers, review what an extension can access, keep wallets off development machines, and monitor developer endpoints for payloads fetched and run outside the editor.