MalwareUsed by 1 actor

Solidity Pro

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

WhiteCobra

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro ("solidity-pro") that has been observed delivering a browser wallet and credential stealer.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence2

This case ultimately demonstrates that assessing extension risk based solely on the current file or current version is far from sufficient ... a clean new version cannot erase the fact that the same name and publisher previously delivered malicious code.

Execution

2 techniques

T1059.006PythonEvidence2

The decrypted text is written to a .py file in a temporary directory with restricted permissions, and then executed via child_process.spawn in detached mode.

T1204.002Malicious FileEvidence1

Once installed, the malicious code can run with the user’s access to local files and browser data...

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

The researchers noted that the samples use obfuscation and split strings to hide their network settings...

T1036MasqueradingEvidence1

the new publishing identity was rapidly given a credibility-oriented appearance ... an enterprise-style profile, six well-known project forks, a product repository, a mature version number, and a 100K+ claim appeared in succession.

T1497Virtualization/Sandbox EvasionEvidence1

...checks for common continuous-integration and sandbox variables help the code avoid analysis systems.

T1497.001System ChecksEvidence1

After the waiting period ends, the code checks for the presence of environment variables such as CI, GITHUB_ACTIONS, JENKINS_HOME, and GITPOD_WORKSPACE_ID, and exits immediately if any are detected.

T1497.003Time Based ChecksEvidence2

After activation, the code does not immediately enter the download phase, but instead sets a randomized waiting window of 24 to 48 hours.

Credential Access

3 techniques

T1528Steal Application Access TokenEvidence1

They searched browser profiles and wallet vaults, then looked for GitHub and GitLab tokens, cloud credentials, API keys, Telegram bot tokens and SSH private keys.

T1552.004Private KeysEvidence1

They searched browser profiles and wallet vaults, then looked for GitHub and GitLab tokens, cloud credentials, API keys, Telegram bot tokens and SSH private keys.

T1555Credentials from Password StoresEvidence1

Later releases, beginning with version 3.0.0, shifted to a focused data-harvesting operation. They searched browser profiles and wallet vaults...

Discovery

4 techniques

T1083File and Directory DiscoveryEvidence1

The SSH directory collection logic enumerates candidate private key files under ~/.ssh/, reads their contents, and passes them to the extractSecrets extractor.

T1497Virtualization/Sandbox EvasionEvidence1

...checks for common continuous-integration and sandbox variables help the code avoid analysis systems.

T1497.001System ChecksEvidence1

After the waiting period ends, the code checks for the presence of environment variables such as CI, GITHUB_ACTIONS, JENKINS_HOME, and GITPOD_WORKSPACE_ID, and exits immediately if any are detected.

T1497.003Time Based ChecksEvidence2

After activation, the code does not immediately enter the download phase, but instead sets a randomized waiting window of 24 to 48 hours.

Collection

1 technique

T1005Data from Local SystemEvidence2

the module actually scans core assets within the developer trust domain ... Project and interaction traces: .env and its variants, API keys, AI service tokens, shell history, and host information.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

After passing the checks, the code sequentially attempts two encoded endpoints and requests the fixed path /firmware from each endpoint. After receiving a response, it verifies the length and uses crypto.createDecipheriv to decrypt it with AES-GCM.

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence2

The collected results are exfiltrated through two HTTP request paths: text JSON is sent via HTTPS to the obfuscated CFG.WORKERS hosts using POST /x, while the complete report is sent to the same group of hosts using multipart/form-data via POST /y.

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app2 months ago

hash.sha256●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

the hacker newsNews

Aug 10, 2026

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Malicious VS Code extension family that initially beaconed to Cloudflare Workers to retrieve and execute an encrypted Python payload, then evolved into a full information stealer harvesting browser profiles, crypto wallets, source-control tokens, API keys, SSH keys, Telegram bot tokens, seed phrases, and credentials, with exfiltration via Telegram bot. It also uses heavy obfuscation, delayed activation, and trust-building clean versions to evade review and sandboxing.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Solidity Pro

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

WhiteCobra

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence2

Execution

2 techniques

T1059.006PythonEvidence2

The decrypted text is written to a .py file in a temporary directory with restricted permissions, and then executed via child_process.spawn in detached mode.

T1204.002Malicious FileEvidence1

Once installed, the malicious code can run with the user’s access to local files and browser data...

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

The researchers noted that the samples use obfuscation and split strings to hide their network settings...

T1036MasqueradingEvidence1

T1497Virtualization/Sandbox EvasionEvidence1

...checks for common continuous-integration and sandbox variables help the code avoid analysis systems.

T1497.001System ChecksEvidence1

After the waiting period ends, the code checks for the presence of environment variables such as CI, GITHUB_ACTIONS, JENKINS_HOME, and GITPOD_WORKSPACE_ID, and exits immediately if any are detected.

T1497.003Time Based ChecksEvidence2

After activation, the code does not immediately enter the download phase, but instead sets a randomized waiting window of 24 to 48 hours.

Credential Access

3 techniques

T1528Steal Application Access TokenEvidence1

They searched browser profiles and wallet vaults, then looked for GitHub and GitLab tokens, cloud credentials, API keys, Telegram bot tokens and SSH private keys.

T1552.004Private KeysEvidence1

They searched browser profiles and wallet vaults, then looked for GitHub and GitLab tokens, cloud credentials, API keys, Telegram bot tokens and SSH private keys.

T1555Credentials from Password StoresEvidence1

Later releases, beginning with version 3.0.0, shifted to a focused data-harvesting operation. They searched browser profiles and wallet vaults...

Discovery

4 techniques

T1083File and Directory DiscoveryEvidence1

The SSH directory collection logic enumerates candidate private key files under ~/.ssh/, reads their contents, and passes them to the extractSecrets extractor.

T1497Virtualization/Sandbox EvasionEvidence1

...checks for common continuous-integration and sandbox variables help the code avoid analysis systems.

T1497.001System ChecksEvidence1

After the waiting period ends, the code checks for the presence of environment variables such as CI, GITHUB_ACTIONS, JENKINS_HOME, and GITPOD_WORKSPACE_ID, and exits immediately if any are detected.

T1497.003Time Based ChecksEvidence2

After activation, the code does not immediately enter the download phase, but instead sets a randomized waiting window of 24 to 48 hours.

Collection

1 technique

T1005Data from Local SystemEvidence2

the module actually scans core assets within the developer trust domain ... Project and interaction traces: .env and its variants, API keys, AI service tokens, shell history, and host information.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence2

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app2 months ago

hash.sha256●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

the hacker newsNews

Aug 10, 2026

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.