Malicious "Solidity Pro" VS Code Extension Exposed as Advanced Info-Stealer Targeting Web3 Developers

Executive Overview

In an escalating wave of supply-chain attacks targeting software developers, cybersecurity researchers have uncovered a malicious Microsoft Visual Studio Code (VS Code) extension masquerading as a legitimate development tool. Dubbed Solidity Pro (solidity-pro), the fraudulent extension was meticulously engineered to deliver a potent suite of browser-wallet loggers and multi-faceted credential stealers straight to unsuspecting blockchain and smart-contract engineers.

Discovered by threat-intelligence analysts at Yeeth Security, the campaign highlights a sophisticated, multi-stage evolution in modern developer-targeted malware. Rather than relying on simple, easily detectable scripts, the threat actors behind Solidity Pro utilized advanced obfuscation techniques, delayed activation timers, and legitimate IDE application programming interfaces (APIs) to evade automated store scanners, static analysis tools, and casual sandboxing.

While the malicious extension has since been pulled from the Open VSX marketplace, its lingering presence on public source code repositories—specifically GitHub under the handle web3devtoolsx/solidity-pro—underscores the persistent threat open-source ecosystems face. This campaign bears the distinct operational hallmarks of WhiteCobra, a known threat cluster previously tied to the distribution of Lumma Stealer and other high-profile IDE-based malware variants.

Detailed Chronology and Technical Breakdown

The campaign’s trajectory reveals a calculated strategy by the threat actors to build user trust, bypass initial automated safety checks, and progressively scale up malicious payloads over multiple version iterations.

Early Iterations (Versions 1.0.0 through v2.4.x)

According to technical breakdowns provided by Yeeth Security, the earliest iterations of the Solidity Pro extension operated under the radar as seemingly functional utilities for developers writing Ethereum smart contracts in Solidity. However, beneath the surface hood, versions 1.0.0 through v2.4.x were hardcoded to beacon out to Cloudflare Workers endpoints.

Upon successfully establishing a connection with these command-and-control (C2) servers, the extension would fetch an encrypted Python payload, drop it onto the host system, and silently execute it. This initial framework allowed the attackers to establish persistent footholds on compromised developer machines without raising immediate flags within the host IDE environment.

The Pivot to Full-Scale Information Stealing (Version 3.0.0 and Later)

Beginning with the release of version 3.0.0, the operation matured into a fully realized, high-efficiency information stealer. Rather than fetching a separate Python script, the extension itself was refactored to directly harvest a massive array of sensitive system data. Once extracted, the payloads are bundled and exfiltrated directly via automated Telegram bot uploads—a preferred exfiltration mechanism for modern cybercrime groups seeking anonymity and rapid data processing.

The comprehensive roster of data harvested by Solidity Pro includes:

• Browser Profiles & Session Data: Extracting cookies, autofill history, and stored credentials from major chromium-based web browsers.
• Crypto Wallet Extensions: Targeting browser-based Web3 wallets (such as MetaMask, Phantom, and others) to drain digital assets.
• Source-Control Tokens: Scraping authentication tokens for platforms like GitHub, GitLab, and Bitbucket.
• Development & API Keys: Plundering hardcoded API keys for cloud providers, payment processors, and SaaS platforms.
• SSH Keys: Stealing private cryptographic keys used for secure server access and remote infrastructure management.
• Communication Tokens: Accessing local Telegram session data and bot tokens.

Evasion Techniques and Defense Evasion

One of the most concerning aspects of the Solidity Pro campaign is its resilience against standard security tooling. The threat actors employed a battery of defensive countermeasures to ensure the malware survived the vetting processes of open-source registries:

1. Heavy Code Obfuscation: The code does not rely on simple string manipulation. It actively splits critical strings across Immediately Invoked Function Expression (IIFE) tables, reassembling them dynamically only at runtime. Method names are frequently swapped between releases, forcing signature-based detection systems to chase a constantly moving target.
2. Randomized Delayed Activation: To defeat automated sandboxes that analyze packages for only a few minutes, the malicious routine incorporates randomized sleep timers. The code remains dormant for several hours or even days after installation. By the time the malicious branch finally executes, the developer has already integrated the extension into their daily workflow, assuming it is entirely benign.
3. Trust-Building Precedents: The authors initially published functional, clean versions of the software to build positive user reviews and establish legitimacy within the community before pushing malicious updates.

Supporting Context, Metrics, and Ecosystem Trends

The discovery of Solidity Pro is far from an isolated incident. It represents a broader, highly lucrative strategic shift by cybercriminals toward poisoning developer ecosystems. Because developers routinely grant high-privilege access to their local machines—including environment variables, production database credentials, source code repositories, and private cryptographic keys—they have become prime targets for financially motivated threat groups.

The WhiteCobra Connection

Security researchers have formally linked the tactics, techniques, and procedures (TTPs) observed in the Solidity Pro campaign directly to WhiteCobra. First flagged by the security community in September 2025, WhiteCobra made headlines for weaponizing popular developer environments like VS Code, Cursor, and Windsurf to deploy aggressive info-stealers such as Lumma Stealer. The reuse of similar infrastructure, obfuscation libraries, and Telegram exfiltration channels confirms that seasoned actors are doubling down on IDE supply-chain vectors.

A History of Compromised Solidity Tools

The Web3 and blockchain development community has proven to be a recurring target due to the high concentration of cryptocurrency wealth among its users.

• In June 2026, Yeeth Security unmasked another fraudulent extension named ethdevtools.solidity-language-support.
• Posing as an essential language-support tool for Ethereum developers, the extension harbored a delayed-activation clipboard stealer designed specifically to scrape BIP-39 seed phrases, private Ethereum keys, and wallet addresses.
• Crucially, the ethdevtools malware bypassed traditional endpoint monitoring by leveraging vscode.env.clipboard.writeText—a legitimate first-party API call native to the VS Code architecture. Because this mechanism requires no spawning of child processes, no external network connections during the swap, and no suspicious file writes, static scanners looking for dangerous Node.js imports failed to trigger.

Official Statements and Industry Response

In the wake of these persistent supply-chain incursions, cybersecurity analysts and repository administrators have stepped up monitoring efforts. Representatives from Yeeth Security emphasized the unique difficulty of defending against IDE-level compromises:

"By the time the malicious branch runs, the user has already decided the extension is useful, and automated scanners that only observe the package for minutes have moved on," researchers noted in their joint technical analysis. "The obfuscation is not decorative; it splits strings across IIFE tables, reassembles them at runtime, and switches method names between releases so signature-based detection must track a moving target."

Platform administrators have moved swiftly to purge identified malicious extensions from the Open VSX registry. However, the persistence of rogue repositories on decentralized platforms like GitHub highlights the ongoing friction between open-source accessibility and rigorous vetting frameworks.

Security architects recommend that enterprise security teams implement strict endpoint policies regarding which extensions are permitted within corporate development environments. Organizations are urged to enforce centralized extension management, allowing only pre-approved, digitally signed tools to be installed within developer workstations.

Future Outlook: Securing the Developer Supply Chain

As artificial intelligence-assisted coding environments, cloud-native IDEs, and modular extension marketplaces continue to expand, the attack surface for software engineers will only widen. Threat actors have recognized that compromising a single developer’s machine yields exponentially higher returns than targeting standard enterprise end-users, given the downstream access to production infrastructure, proprietary source code, and decentralized finance (DeFi) protocols.

To safeguard against future iterations of campaigns like Solidity Pro and WhiteCobra, the cybersecurity community advocates for a multi-layered defense strategy:

1. Immediate Remediation for Impactful Users: Any developer who installed Solidity Pro, ethdevtools, or related unverified Web3 extensions should immediately purge them from their systems, revoke all active API keys, rotate SSH credentials, and clear browser session tokens.
2. Behavioral Endpoint Monitoring: Security operations centers (SOCs) must configure alerts for unusual process executions originating from IDE directories, specifically targeting the anomalous use of command-line utilities such as cscript, mshta, cmd, curl, and powershell.
3. Dependency Graph Inspection: Regular audits of project dependencies and IDE extension inventories can help catch unauthorized or newly updated packages before they exfiltrate sensitive data.
4. Enhanced Marketplace Vetting: Registry operators must implement deeper, behavior-based sandboxing that monitors extension activity over extended time horizons rather than relying solely on static, short-duration metadata scans.

As long as developer environments remain lucrative treasure troves of cryptographic and corporate credentials, adversaries will continue to innovate their delivery mechanisms. Maintaining rigorous hygiene, practicing zero-trust local development, and fostering cross-industry intelligence sharing remain our best defenses against the evolving landscape of software supply-chain threats.