Loading story…
Researchers reported a malicious Visual Studio Code extension campaign using the Solidity Pro name to target Solidity and Web3 developers, stealing cryptocurrency wallet data, developer secrets, and infrastructure credentials. The packages, tied to publishers including helper-beeps and web3devtoolsx, appeared in multiple releases spanning at least versions 1.0.0 through 4.0.0, with some clean-looking intermediate versions likely used to evade marketplace review. Early variants retrieved an encrypted Python payload from Cloudflare Workers after a 12- to 72-hour delay, while later versions evolved into a built-in information stealer.
The malware harvested browser data, wallet vaults, GitHub and GitLab tokens, cloud credentials, API keys, SSH private keys, Telegram bot tokens, and secrets linked to wallets including MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr, then exfiltrated the data through Telegram bot infrastructure. Researchers said the operation used obfuscation, delayed activation, polished branding, and version churn to avoid automated scanning and user suspicion, and noted related malicious VS Code and npm packages as part of a broader developer-focused supply-chain threat in open-source tooling ecosystems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
In June 2026, Yeeth Security identified the malicious VS Code extension ethdevtools.solidity-language-support impersonating a Solidity language-support tool. It used delayed activation and clipboard hijacking to scrape seed phrases, Ethereum private keys, and wallet addresses, then replace copied crypto addresses with attacker-controlled ones.
Yeeth Security said WhiteCobra was previously detected distributing Lumma Stealer through malicious VS Code extensions, providing historical context for the later Solidity Pro activity.
By the time of reporting, the malicious Solidity Pro extensions were no longer available on Open VSX, indicating takedown or removal from the marketplace. The associated GitHub repository for web3devtoolsx/solidity-pro remained accessible at that time.
The reporting linked the Solidity Pro campaign to additional malicious extensions and packages, including helper-beeps.solidity-pro-ai-auditor, iktok90-design.solidity-pro, ChainDevTools.solidity-pro, NomcFoundation.hardhat-solidity, a malicious npm package named ascii-fetcher, and other VS Code extensions delivering droppers. This expanded the story from a single extension to a broader developer-focused supply-chain abuse cluster.
Starting with version 3.0.0, the malicious Solidity Pro extensions evolved from delayed downloaders into full information stealers. The newer variants harvested browser data, wallet vaults, developer tokens, cloud credentials, API keys, SSH keys, Telegram bot tokens, and crypto secrets, then exfiltrated the data via Telegram.
Early Solidity Pro releases, spanning versions 1.0.0 through at least 2.4.x, contacted Cloudflare Workers after a delay, retrieved an encrypted Python payload, and executed it outside VS Code. Yeeth Security tied these releases to publishers including helper-beeps and web3devtoolsx.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourceyeethsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have identified two malicious extensions on the Microsoft Visual Studio Code Marketplace, named *Bitcoin Black* and *Codo AI*, which were designed to infect developer machines with information-stealing malware. These extensions, published under the developer name 'BigBlack', masqueraded as a premium dark theme and an AI-powered coding assistant, but secretly downloaded additional payloads, took screenshots, and exfiltrated sensitive data such as code, emails, Slack messages, WiFi passwords, clipboard contents, and browser sessions to attacker-controlled servers. Microsoft has since removed these extensions from the marketplace after their discovery, but not before they were downloaded and installed by several users. The malware leveraged PowerShell and batch scripts to download and execute payloads, with later versions hiding execution windows to evade user detection. Technical analysis revealed that both extensions delivered a legitimate Lightshot screenshot tool alongside a malicious DLL, which was loaded via DLL hijacking to deploy the infostealer under the name `runtime.exe`. The malicious DLL was detected by multiple antivirus engines and created persistence by establishing directories in the `%APPDATA%\Local\` path. The Codo AI extension embedded its malicious code within a functioning tool, making it harder to detect, while Bitcoin Black activated on every VS Code action. The campaign highlights the risks of third-party extensions in developer environments and the need for vigilance when installing tools from public marketplaces.
Jun 29, 2026
Malicious Visual Studio Code extensions have been discovered on the official marketplace, delivering both ransomware and cryptomining malware to unsuspecting users. One extension, identified as `suspublisher18.susvsex`, was found to contain ransomware functionality, including file encryption, exfiltration for extortion, and the use of GitHub as a command and control channel. The extension's package even included the command and control server code and decryption tools, suggesting a lack of sophistication but highlighting the ease with which such threats can bypass marketplace review processes. The ransomware was initially configured to target a test directory, but this could be easily changed in future updates, posing a significant risk to developers. In addition to ransomware, several other malicious VS Code extensions have been used to deploy cryptomining malware, particularly targeting users interested in coding themes and AI capabilities. Extensions published by "DevelopmentInc" masqueraded as legitimate tools, such as a Pokémon-themed syntax highlighter, but instead downloaded and executed Monero cryptominers. These payloads disabled Windows Defender, escalated privileges, and established persistence on infected systems. Although the identified malicious extensions have been removed from the marketplace, security researchers warn that similar threats may reappear, urging developers to remain vigilant when installing third-party extensions.
Jun 29, 2026
Security researchers reported **malicious Visual Studio Code extensions** being used as a software supply-chain vector to compromise developer workstations. One campaign impersonated a viral AI coding assistant (“**ClawdBot**”) via a fake extension (“ClawdBot Agent”) that appeared legitimate and even functioned as an AI assistant by integrating real APIs (e.g., OpenAI/Anthropic/Google), while **silently dropping malware on Windows at VS Code startup**. The observed payload delivery used camouflage filenames such as `Lightshot.exe` (and references to `Lightshot.dll`) and an Electron-style bundle name `Code.exe`, indicating an effort to blend into common developer tooling and evolve the dropper over time. A separate finding described an **Open VSX** extension masquerading as a popular **Angular Language Service** for VS Code, which bundled legitimate dependencies (e.g., `@angular/language-service` and `typescript`) alongside a **malicious loader** that activates when users open HTML or TypeScript files (`onLanguage:html`, `onLanguage:typescript`). The loader decrypts an embedded payload using **AES-256-CBC** (Node.js `crypto`), with a hardcoded IV and a large hex-encoded ciphertext, then delays and executes the decrypted code—behavior consistent with staged malware delivery and potential worm-like propagation through widely installed editor extensions.
Jun 29, 2026