Malicious 'Solidity Pro' VS Code Extensions Steal Crypto Wallets and Developer Credentials via Telegram Exfiltration
Yeeth Security found 'Solidity Pro' VS Code extensions that evolved from a delayed Cloudflare-Worker dropper into a Telegram-based wallet and credential stealer targeting web3 developers.
Overview
Malicious Visual Studio Code extensions branded “Solidity Pro” have been evolving for months from a delayed downloader into a full credential and cryptocurrency-wallet stealer, according to research from Yeeth Security published August 6, 2026, and covered more widely on August 10 by outlets including The Hacker News, Cyber Security News, GBHackers, and Cyberpress. Yeeth Security tracked two publishers, helper-beeps and web3devtoolsx, shipping versions of a solidity-pro extension aimed at web3 and Solidity developers.
What We Know
Two publishers, one malware family
Yeeth Security identified helper-beeps.solidity-pro and web3devtoolsx.solidity-pro as the same malicious family packaged under different publisher accounts, with a related extension, helper-beeps.solidity-pro-ai-auditor, also flagged. The packages advertised Solidity development, AI auditing, and gas-analysis features, the kind of polished, plausible-sounding tooling that draws in developers searching Open VSX or the VS Code Marketplace. Although neither extension remains available on Open VSX, the GitHub repository for web3devtoolsx/solidity-pro was still reachable as of The Hacker News’ report on August 10.
From Cloudflare dropper to Telegram infostealer
According to Yeeth Security’s analysis, early releases — versions 1.0.0 through 2.4.x — activated components named Web3Analytics and ApiClient, then waited a randomized 12-to-72-hour delay before beaconing to Cloudflare Worker endpoints such as violet-87cardo[.]workers[.]dev. The extension also generated decoy traffic resembling a CoinGecko API request to blend malicious calls into ordinary developer network activity. The Cloudflare server returned an AES-GCM-encrypted Python payload, which the extension decrypted, wrote to a temporary or home-directory path, and launched through Node.js child_process.spawn as a detached process — meaning the Python payload kept running even after the VS Code extension host stopped or the editor was closed.
Starting with version 3.0.0, the family pivoted to a wallet and credential infostealer that harvests browser profiles, crypto wallets, source-control tokens, API keys, SSH keys, and Telegram bot tokens, exfiltrating the data through Telegram bot uploads. Yeeth Security’s full target list includes GitHub ghp_/github_pat_ tokens, GitLab glpat- tokens, AWS keys and session tokens, Cloudflare cfat_ tokens, OpenAI sk-/sk-proj-/sk-ant- keys, mnemonic and seed phrases, Bitcoin WIF and extended private keys, SSH private keys, and 1Password data — plus wallet vaults for MetaMask, Phantom, Rabby, Coinbase, Trust, and Keplr. The overall campaign spans at least versions 1.0.0 through 4.0.0, with web3devtoolsx also shipping apparently clean 1.0.0 and 4.0.0 releases carrying only benign-looking components such as GasTracker and PriceMonitor — decoys Yeeth Security believes are used to build publisher reputation or test how quickly a benign upload clears review after a malicious version is removed.
Built to dodge scanners
Beyond the delay itself, samples checked for CI and sandbox environment variables — CI, GITHUB_ACTIONS, JENKINS_HOME, and GITPOD_WORKSPACE_ID — as an anti-analysis measure to avoid detonating in monitored environments. Yeeth Security said that “by the time the malicious branch runs, the user has already decided the extension is useful, and automated scanners that only observe the package for minutes have moved on,” adding that the obfuscation “is not decorative; it splits strings across IIFE tables, reassembles them at runtime, and switches method names between releases so signature-based detection must track a moving target.”
A recurring playbook
Yeeth Security said the campaign shares tradecraft with WhiteCobra, a cluster detected in September 2025 distributing Lumma Stealer through malicious VS Code extensions. Yeeth Security’s own earlier report, “WhiteCobra Beginnings,” had already documented a related campaign that impersonated the NomcFoundation.hardhat-solidity extension and, in that separate incident, stole $500,000 from one developer. Yeeth Security also cited public reporting from Koi Security describing a leaked WhiteCobra document titled “DEPLOYMENT PLAN: Operation Solidity Pro,” which reportedly outlined a five-phase strategy of packaging, deployment to Open VSX, social-media promotion, download inflation to 50,000 or more installs for social proof, and real-time monitoring of stolen seed phrases; that document named ChainDevTools.solidity-pro among its target extension listings.
This is not the first bogus Solidity tool Yeeth Security has flagged this year. In June 2026, the firm identified a separate extension, ethdevtools.solidity-language-support, that impersonated Solidity language-support tooling but carried a delayed-activation clipboard stealer scraping BIP-39 seed phrases, Ethereum private keys, and wallet addresses by swapping clipboard contents through the vscode.env.clipboard.writeText API.
Users who installed the flagged extensions are advised to remove them, inspect dependency graphs, block known command-and-control domains, and alert on unexpected use of cscript, mshta, cmd, curl, and powershell commands.
What We Don’t Know
None of the sources reviewed disclose how many developers installed the malicious Solidity Pro extensions or how much cryptocurrency or credential material was actually exfiltrated before the packages were pulled from Open VSX. Attribution to WhiteCobra specifically remains cautious — Cyberpress noted the observed Solidity Pro samples are “technically distinct” from prior WhiteCobra artifacts, so the link is based on shared tradecraft and targeting rather than confirmed shared authorship. It is also not established whether ChainDevTools.solidity-pro, named in the leaked WhiteCobra deployment plan, was itself ever published with malicious code, as opposed to simply being listed as a target for impersonation.