Malicious Solidity Pro VS Code Extension Steals Crypto Wallets, API Keys and SSH Keys via Telegram

Malicious extensions are turning a routine developer task into a route for theft.

A package named Solidity Pro, promoted as a useful tool for Solidity work in Visual Studio Code, has been used to steal cryptocurrency wallet data and developer secrets.

The activity shows how a believable extension name, polished documentation and features can lower a developer’s guard.

Once installed, the malicious code can run with the user’s access to local files and browser data, placing digital assets, source-control access and infrastructure credentials at risk.

Analysts at Yeeth Security identified two publishers, helper-beeps and web3devtoolsx, distributing related Solidity Pro packages.

The researchers found that the campaign changed over time, moving from a delayed downloader to a more direct information stealer that sends collected material through Telegram.

Yeeth Security said in a report shared with Cyber Security News (CSN) that the affected releases span at least versions 1.0.0 to 4.0.0, with some clean-looking releases mixed in.

That version churn can make a publisher appear harmless during a quick review, while malicious versions stay available long enough to reach developers.

Malicious Solidity Pro VS Code Extension Steals Crypto Wallets

The early Solidity Pro samples contacted Cloudflare Worker infrastructure after a random delay of 12 to 72 hours.

They retrieved an encrypted Python payload, wrote it to a temporary location and started it outside the editor, a pattern that can outlast the extension host and evade short automated checks.

Later releases, beginning with version 3.0.0, shifted to a focused data-harvesting operation.

They searched browser profiles and wallet vaults, then looked for GitHub and GitLab tokens, cloud credentials, API keys, Telegram bot tokens and SSH private keys.

This mirrors the risk described in earlier malicious Solidity extensions, where trusted editor add-ons became a route to wallet and credential theft.

Malware also targets seed phrases and wallets associated with MetaMask, Phantom, Rabby, Coinbase, Trust and Keplr.

Stolen data is packaged for upload to Telegram bot endpoints, giving operators a simple channel to receive valuable material without maintaining a server.

The researchers noted that the samples use obfuscation and split strings to hide their network settings, while checks for common continuous-integration and sandbox variables help the code avoid analysis systems.

The campaign resembles a wider pattern of supply-chain abuse. A recent Open VSX extension backdoor likewise hid harmful behavior in selected versions, showing why a clean current release does not prove that an earlier installed version was safe.

Why Developers Need to Check Extensions

Solidity and Web3 developers are particularly attractive targets because their machines may hold wallet access, deployment credentials and code for valuable projects.

The use of familiar branding and publisher names that blend into search results creates an attack vector before a victim ever runs a project or opens a suspicious file.

The response starts with reviewing installed editor extensions, their publisher identities and the exact version in use.

Remove unneeded add-ons, treat unfamiliar premium-sounding Solidity tools as unverified, and investigate extensions that request access or make unexpected outbound connections.

Teams should avoid storing seed phrases, private keys and long-lived tokens in editor-accessible files.

Hardware wallets and separate secret-handling workflows reduce the damage from a compromised workstation, while rotating exposed keys quickly can prevent further misuse.

Similar malicious npm supply-chain campaigns show that the same caution must apply to dependencies as well as extensions.

Organizations can strengthen detection by monitoring extension installations and outbound traffic, checking publishers for name similarity and reviewing new releases before broad deployment.

Clean rebuilds of potentially affected developer systems are safer than assuming removal alone ends access, especially when stolen SSH keys or tokens may still work elsewhere.

Developers should also inspect CI environments, revoke Telegram bot tokens where appropriate, and rotate wallet-related secrets after any suspected exposure.

The Telegram-driven developer secret theft seen in other malicious packages reinforces a basic lesson: marketplace popularity and a familiar name are not evidence that code is trustworthy.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Malicious extension	helper-beeps.solidity-pro	Observed malicious Solidity Pro extension identifier
Malicious extension	helper-beeps.solidity-pro-ai-auditor	Related malicious extension identifier
Malicious extension	web3devtoolsx.solidity-pro	Observed malicious Solidity Pro extension identifier
Malicious extension	iktok90-design.solidity-pro	Impostor Solidity Pro extension identifier
Related extension	NomcFoundation.hardhat-solidity	Earlier Solidity-themed impersonation sample linked in the research
Related extension	ChainDevTools.solidity-pro	Extension named in the reported Operation Solidity Pro playbook
SHA-256	0a9da2b33c94da3f1fc02502ab3caed6e1fbe40f9115422c09103c42a9f8b3d1	helper-beeps version 1.0.0 extension.js
SHA-256	da38bd92ead5c3993cce5a940066dd226cbe4c1f3bbfafbeb91e093813479a89	helper-beeps version 2.4.1 extension.js
SHA-256	b721113f3e747c38cda0e5a6a1de9b28bf64bd8391d291177a4d3eae5bf0bbc3	helper-beeps version 3.0.0 extension.js
SHA-256	20c2a806619e1f32b3adc78689366959089d1a5de17a59a924bf477284785b5f	helper-beeps version 3.1.0 extension.js
SHA-256	740b461724784e04d6872824904c244016408b30cbbf6c89c069048df9321178	Truncated hash reported for web3devtoolsx version 3.4.0 infostealer
Domain	violet-87cardo[.]workers[.]dev	Cloudflare Worker endpoint used by early dropper releases
Domain	cardo[.]workers[.]dev	Decoded Cloudflare Worker domain fragment
Domain	soft-feather-7807.0x.cloudflare-workers[.]workers[.]dev	Cloudflare Worker endpoint used by early dropper releases
Domain fragment	cold-peak-60871	Decoded worker subdomain fragment in later releases
Domain fragment	steel-mere-orker	Decoded worker subdomain fragment in later releases
Domain fragment	richardorichp	Decoded worker subdomain fragment in later releases
Domain fragment	0x0gnx0	Decoded worker subdomain fragment in later releases
File name	extension.js	Extension entry-point file containing staged or embedded malicious logic
File name	.vscode_sol_analytics_<timestamp>.py	Temporary Python payload name used by some early variants
File name	Optimizer.js	File associated with the earlier Solidity-themed backdoor sample

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world