Critical VS Code Extension Steals Crypto Wallets, API Keys, SSH Keys

Key Takeaways

• A malicious Visual Studio Code (VS Code) extension, “Solidity Pro,” has been observed actively stealing cryptocurrency wallet data, API keys, and SSH keys.
• Threat actors leveraged seemingly legitimate publisher names and professional documentation to trick developers into installing the trojanized extension.
• The attack campaign evolved from a delayed downloader to a direct information stealer, exfiltrating stolen data via Telegram bot endpoints.
• Developers using VS Code, especially those in Web3 and Solidity development, are urged to review installed extensions, verify publishers, and implement strong security practices for sensitive credentials.

A deceptive VS Code extension, masquerading as a legitimate tool for Solidity development, has been uncovered stealing sensitive data from unsuspecting developers. Dubbed “Solidity Pro,” this malicious package has been actively siphoning off cryptocurrency wallet information, API keys, and SSH keys, turning a common developer utility into a significant security risk.

The campaign highlights a growing trend where attackers exploit the trust developers place in marketplace extensions. By employing convincing extension names, polished documentation, and seemingly useful features, threat actors successfully bypass initial scrutiny, enabling their malicious code to execute with elevated user permissions. This access allows the malware to compromise local files and browser data, endangering digital assets, source-control access, and critical infrastructure credentials.

Analysts at Yeeth Security identified in a report that two publishers, “helper-beeps” and “web3devtoolsx,” were responsible for distributing various related “Solidity Pro” packages. The researchers noted that the attack methodology evolved over time, transitioning from a stealthy, delayed downloader to a more direct information-stealing operation that transmits exfiltrated data through Telegram.

The affected “Solidity Pro” releases reportedly spanned versions 1.0.0 to 4.0.0, with some benign-looking versions interspersed among the malicious ones. This version obfuscation tactic can mislead developers during quick reviews, allowing malicious versions to remain active long enough to compromise a significant number of targets.

Evolution of the Malicious Solidity Pro Campaign

Early iterations of the malicious “Solidity Pro” extensions were designed to establish a covert foothold. After a randomized delay of 12 to 72 hours, these samples would contact Cloudflare Worker infrastructure to retrieve an encrypted Python payload. This payload was then written to a temporary location and executed outside the VS Code editor environment. This method allowed the malware to persist beyond the extension’s lifecycle and bypass many automated security checks.

Starting with version 3.0.0, the campaign shifted to a more direct data exfiltration strategy. These later releases systematically targeted browser profiles and cryptocurrency wallet vaults. They also actively sought out GitHub and GitLab tokens, cloud service credentials, various API keys, Telegram bot tokens, and SSH private keys. This aggressive data harvesting mirrors the risks previously identified in other malicious Solidity extensions, where seemingly trusted editor add-ons became conduits for credential and wallet theft.

The malware specifically targets seed phrases and wallets associated with popular platforms such as MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr. Once collected, the stolen data is compressed and uploaded to Telegram bot endpoints. This approach provides the attackers with a simple and efficient channel for receiving valuable information without the overhead of maintaining their own command-and-control servers.

The researchers further noted that the malicious samples employed obfuscation techniques and split strings to conceal their network configurations. Additionally, checks for common continuous integration (CI) and sandbox environment variables were implemented to evade detection by analysis systems. This campaign aligns with a broader pattern of supply-chain attacks, reminiscent of a recent Open VSX extension backdoor that similarly hid harmful behaviors within specific versions, underscoring that a clean current release does not guarantee the safety of earlier installed versions.

Why Developers Must Scrutinize Extensions

Developers specializing in Solidity and Web3 technologies are particularly attractive targets for such attacks. Their development environments frequently contain direct access to cryptocurrency wallets, deployment credentials, and proprietary code for high-value projects. The use of familiar branding and publisher names designed to blend seamlessly into search results creates an insidious attack vector, often before a victim even executes a project or opens a suspicious file.

What You Should Do

• Review Installed Extensions: Regularly audit all installed VS Code extensions. Verify the publisher’s identity and the exact version in use. Remove any unneeded or unfamiliar add-ons.
• Exercise Caution with New Tools: Treat any premium-sounding or unfamiliar Solidity-related tools as unverified. Thoroughly investigate extensions that request unusual permissions or initiate unexpected outbound connections.
• Secure Sensitive Credentials: Avoid storing seed phrases, private keys, and long-lived tokens directly within editor-accessible files. Utilize hardware wallets and implement dedicated secret-handling workflows to minimize damage from a compromised workstation.
• Rotate Exposed Keys: In the event of suspected exposure, immediately rotate any compromised API keys, SSH keys, or other credentials to prevent further misuse.
• Monitor and Control Installations: Organizations should implement robust monitoring of extension installations and outbound network traffic. Scrutinize publishers for name similarities to known entities and thoroughly review new releases before widespread deployment.
• Clean Rebuilds: For potentially affected developer systems, perform clean rebuilds rather than simply removing the extension. Stolen SSH keys or tokens may still be active and usable elsewhere.
• Inspect CI Environments and Revoke Tokens: Review CI environments for any signs of compromise and revoke Telegram bot tokens or other service tokens if their security is in question.
• Prioritize Trust: Understand that marketplace popularity and familiar names do not inherently guarantee code trustworthiness. Always prioritize security best practices over convenience.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.