Cybersecurity researchers discovered a malicious VS Code extension named Solidity Pro that steals browser credentials, crypto wallets, and other sensitive data via a Telegram bot. The extension uses heavy obfuscation, delayed activation, and supply‑chain tactics to evade detection, echoing the playbook of the WhiteCobra threat group. Recent investigations also uncovered related rogue extensions, npm packages, and techniques targeting developers worldwide.
| IOC Type | Value | Description | Relevant MITRE ATT&CK Techniques |
|---|---|---|---|
| Filename |
DigitalBarberTrim.html-entity-codec
|
VS Code extension dropping remote VSIX | T1195.002|T1567.002 |
| Filename |
helper-beeps.solidity-pro
|
Another malicious VS Code extension variant | T1195.002|T1204.001 |
| Filename |
web3devtoolsx.solidity-pro
|
Malicious VS Code extension with info stealer | T1195.002|T1204.001 |
| Filename |
solidity-pro
|
Malicious VS Code extension delivering credential stealer | T1195.002|T1204.001 |
| Filename |
ascii-fetcher
|
NPM package embedding malicious payload | T1059.001|T1071 |
| Filename |
@jaymara/jsononifier
|
Malicious dependency used to decode and execute commands | T1059.001 |
| Filename |
calc.exe
|
Demo payload executed via system() call to demonstrate RCE; indicators include suspicious child process spawning from Semantic Kernel agent hosts. | T1059.001|T1059.006 |
| Path |
web3devtoolsx/solidity-pro
|
GitHub repository still hosting malicious extension | T1195.002 |
| Code | Title |
|---|---|
| T1195.002 | Supply chain compromise of open‑source VS Code extensions |
| T1027 | Obfuscated Files or Information - Obfuscated files or information to evade signature detection |
| T1204.001 | User execution of malicious file (VS Code extension) |
| T1552.001 | Unsecured credentials from web browsers (stealing browser profiles) |
| T1555 | Credentials from password managers (e.g., 1Password tokens) |
| T1560.001 | Credentials from password dumps (Mnemonic/seed phrases) |
| T1567.002 | Exfiltration over web service (Telegram bot upload) |
| T1059.001 | Command and Scripting Interpet: PowerShell - PowerShell command‑line interface used in payloads |
| T1059.003 | VBScript execution (cscript/mshta) observed in droppers |
| T1568.002 | Dynamic resolution for C2 (Cloudflare Workers) |
| Type | Value |
|---|---|
| Sector | Software Development / Blockchain Development |
Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro ("
"The obfuscation is not decorative; it splits strings across IIFE tables, reassembles them at runtime, and switches method names between releases so signature-based detection must track a moving target." The cybersecurity company said the activity shares the same high-level playbook as WhiteCobra , another threat cluster that was detected in September 2025 as distributing Lumma Stealer through malicious VS Code extensions. This is not the first time threat actors have published bogus Solidity extensions across open-source ecosystems . In June 2026, Yeeth Security flagged another extension named " ethdevtools.solidity-language-support " that impersonated a Solidity language-support tool for Ethereum developers, but harbored a delayed-activation clipboard stealer to scrape BIP-39 seed phrases, Ethereum private keys, and wallet addresses. "When a recognized crypto address is on the clipboard, it replaces the pasted value with an attacker-controlled address," it added. "The swap happens through vscode.env.clipboard.writeText, a first-party API call that requires no child_process, no network access, and no file writes.
Static scanners that only look for dangerous Node imports will not see it." The findings also coincide with the discovery of a number of rogue VS Code extensions and npm packages - An npm package called "