Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
Summary: Researchers at Yeeth Security flagged a malicious VS Code extension named Solidity Pro that delivered a browser wallet and credential stealer, with early versions 1.0.0 through v2.4.x beaconing to Cloudflare Workers endpoints to fetch and run an encrypted Python payload. Versions from v3.0.0 onward became a full information stealer collecting browser profiles, crypto wallets, source-control tokens, API keys, SSH keys, and Telegram bot tokens, exfiltrated through a Telegram bot upload.
What you should know: The extension used randomized delayed activation so the malicious code ran hours or days after installation, after users had judged it useful and automated scanners had moved on - and its GitHub repository remained accessible even after it left Open VSX.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026