Malicious extensions are turning a routine developer task into a route for theft.

A package named Solidity Pro, promoted as a useful tool for Solidity work in Visual Studio Code, has been used to steal cryptocurrency wallet data and developer secrets.

The activity shows how a believable extension name, polished documentation and features can lower a developer’s guard.

Once installed, the malicious code can run with the user’s access to local files and browser data, placing digital assets, source-control access and infrastructure credentials at risk.

Analysts at Yeeth Security identified two publishers, helper-beeps and web3devtoolsx, distributing related Solidity Pro packages.

The researchers found that the campaign changed over time, moving from a delayed downloader to a more direct information stealer that sends collected material through Telegram.

Yeeth Security said in a report shared with Cyber Security News (CSN) that the affected releases span at least versions 1.0.0 to 4.0.0, with some clean-looking releases mixed in.

That version churn can make a publisher appear harmless during a quick review, while malicious versions stay available long enough to reach developers.

Malicious Solidity Pro VS Code Extension Steals Crypto Wallets

The early Solidity Pro samples contacted Cloudflare Worker infrastructure after a random delay of 12 to 72 hours.

They retrieved an encrypted Python payload, wrote it to a temporary location and started it outside the editor, a pattern that can outlast the extension host and evade short automated checks.

Later releases, beginning with version 3.0.0, shifted to a focused data-harvesting operation.

They searched browser profiles and wallet vaults, then looked for GitHub and GitLab tokens, cloud credentials, API keys, Telegram bot tokens and SSH private keys.

This mirrors the risk described in earlier malicious Solidity extensions, where trusted editor add-ons became a route to wallet and credential theft.

Malware also targets seed phrases and wallets associated with MetaMask, Phantom, Rabby, Coinbase, Trust and Keplr.

Stolen data is packaged for upload to Telegram bot endpoints, giving operators a simple channel to receive valuable material without maintaining a server.

The researchers noted that the samples use obfuscation and split strings to hide their network settings, while checks for common continuous-integration and sandbox variables help the code avoid analysis systems.

The campaign resembles a wider pattern of supply-chain abuse. A recent Open VSX extension backdoor likewise hid harmful behavior in selected versions, showing why a clean current release does not prove that an earlier installed version was safe.

Why Developers Need to Check Extensions

Solidity and Web3 developers are particularly attractive targets because their machines may hold wallet access, deployment credentials and code for valuable projects.

The use of familiar branding and publisher names that blend into search results creates an attack vector before a victim ever runs a project or opens a suspicious file.

The response starts with reviewing installed editor extensions, their publisher identities and the exact version in use.

Remove unneeded add-ons, treat unfamiliar premium-sounding Solidity tools as unverified, and investigate extensions that request access or make unexpected outbound connections.

Teams should avoid storing seed phrases, private keys and long-lived tokens in editor-accessible files.

Hardware wallets and separate secret-handling workflows reduce the damage from a compromised workstation, while rotating exposed keys quickly can prevent further misuse.

Similar malicious npm supply-chain campaigns show that the same caution must apply to dependencies as well as extensions.

Organizations can strengthen detection by monitoring extension installations and outbound traffic, checking publishers for name similarity and reviewing new releases before broad deployment.

Clean rebuilds of potentially affected developer systems are safer than assuming removal alone ends access, especially when stolen SSH keys or tokens may still work elsewhere.

Developers should also inspect CI environments, revoke Telegram bot tokens where appropriate, and rotate wallet-related secrets after any suspected exposure.

The Telegram-driven developer secret theft seen in other malicious packages reinforces a basic lesson: marketplace popularity and a familiar name are not evidence that code is trustworthy.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Malicious extension	`helper-beeps.solidity-pro`	Observed malicious Solidity Pro extension identifier
Malicious extension	`helper-beeps.solidity-pro-ai-auditor`	Related malicious extension identifier
Malicious extension	`web3devtoolsx.solidity-pro`	Observed malicious Solidity Pro extension identifier
Malicious extension	`iktok90-design.solidity-pro`	Impostor Solidity Pro extension identifier
Related extension	`NomcFoundation.hardhat-solidity`	Earlier Solidity-themed impersonation sample linked in the research
Related extension	`ChainDevTools.solidity-pro`	Extension named in the reported Operation Solidity Pro playbook
SHA-256	`0a9da2b33c94da3f1fc02502ab3caed6e1fbe40f9115422c09103c42a9f8b3d1`	`helper-beeps` version 1.0.0 `extension.js`
SHA-256	`da38bd92ead5c3993cce5a940066dd226cbe4c1f3bbfafbeb91e093813479a89`	`helper-beeps` version 2.4.1 `extension.js`
SHA-256	`b721113f3e747c38cda0e5a6a1de9b28bf64bd8391d291177a4d3eae5bf0bbc3`	`helper-beeps` version 3.0.0 `extension.js`
SHA-256	`20c2a806619e1f32b3adc78689366959089d1a5de17a59a924bf477284785b5f`	`helper-beeps` version 3.1.0 `extension.js`
SHA-256	`740b461724784e04d6872824904c244016408b30cbbf6c89c069048df9321178`	Truncated hash reported for `web3devtoolsx` version 3.4.0 infostealer
Domain	`violet-87cardo[.]workers[.]dev`	Cloudflare Worker endpoint used by early dropper releases
Domain	`cardo[.]workers[.]dev`	Decoded Cloudflare Worker domain fragment
Domain	`soft-feather-7807.0x.cloudflare-workers[.]workers[.]dev`	Cloudflare Worker endpoint used by early dropper releases
Domain fragment	`cold-peak-60871`	Decoded worker subdomain fragment in later releases
Domain fragment	`steel-mere-orker`	Decoded worker subdomain fragment in later releases
Domain fragment	`richardorichp`	Decoded worker subdomain fragment in later releases
Domain fragment	`0x0gnx0`	Decoded worker subdomain fragment in later releases
File name	`extension.js`	Extension entry-point file containing staged or embedded malicious logic
File name	`.vscode_sol_analytics_`	Temporary Python payload name used by some early variants
File name	`Optimizer.js`	File associated with the earlier Solidity-themed backdoor sample

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world

The post Malicious Solidity Pro VS Code Extension Steals Crypto Wallets, API Keys and SSH Keys via Telegram appeared first on Cyber Security News.