Stealer Extensions in VS Code: Wallets and Keys Leave via a Telegram Bot
A pair of malicious VS Code extensions calling themselves Solidity Pro spent months looking like ordinary developer tooling before turning into credential stealers. Yeeth Security published the analysis on 6 August 2026, and the detail that matters is not the payload but the patience: the malicious code waits between twelve and seventy-two hours after installation before it runs. By then the marketplace scanner has finished, and the developer has decided the extension is useful.
What the Solidity Pro Extensions Actually Did
The extensions shipped under several publisher identities, among them helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, on Open VSX and the VS Code Marketplace. They posed as tooling for Solidity, the language used to write Ethereum smart contracts, which puts the target audience in a useful position for an attacker: people who keep wallet keys on their working machine.
The behaviour changed with the version number. Releases 1.0.0 through 2.4.x acted as a dropper, beaconing to Cloudflare Workers endpoints, pulling down an AES-GCM encrypted Python payload and running it through child_process.spawn. Versions 2.4.7 and 2.4.8 kept the same skeleton with heavier obfuscation. From 3.0.0 onward the extension carried a full crypto wallet stealer, and the newest versions dropped the Cloudflare stage entirely in favour of uploading straight to a Telegram bot. Publisher web3devtoolsx also shipped clean, harmless builds numbered 1.0.0 and 4.0.0, which is how a package earns a plausible history.
What the Crypto Wallet Stealer Takes
The harvest list reads like an inventory of a developer's entire working life. On the credential side: GitHub tokens in both ghp_ and github_pat_ forms, GitLab glpat- tokens, AWS keys and session tokens, Cloudflare tokens, OpenAI and Anthropic API keys, and Telegram bot tokens. On the cryptographic side: SSH private keys, Bitcoin WIF and xprv keys, mnemonic seed phrases, and the wallet vaults of MetaMask, Phantom, Rabby, Coinbase, Trust and Keplr. It also collects credentials embedded in URLs and 1Password MFA tokens.
How It Got Past Review: Twelve to Seventy-Two Hours of Patience
The delay is configured as a random interval between twelve and seventy-two hours after installation. Before activating, the payload checks environment variables that give away an automated environment, including CI, GITHUB_ACTIONS, JENKINS_HOME and GITPOD_WORKSPACE_ID, and stays dormant if it finds them. A scanner that installs a package, watches it for a few minutes and moves on will see a Solidity helper doing nothing unusual, because at that moment it genuinely is doing nothing unusual.
The rest is craft rather than novelty: endpoint addresses stored as hex fragments and reassembled at runtime, strings split across immediately-invoked function tables, base64 blobs passed through eval(), and method names rotated between releases so that a signature written for one version does not match the next. Early versions even made a decoy request to a public CoinGecko price endpoint, which is exactly what a genuine crypto development tool would do.
The WhiteCobra Playbook and Fake Download Counts
Yeeth links this campaign to WhiteCobra, a cluster that has been flooding extension marketplaces since 2025, while noting the artefacts differ enough that the attribution is a behavioural match rather than a byte-for-byte one. The comparison is worth making because the group's own planning document leaked. In September 2025, Koi Security published a file titled "DEPLOYMENT PLAN: Operation Solidity Pro", recovered from a campaign of 24 malicious extensions across the VS Code Marketplace and Open VSX.
It is written like a product launch. Five phases: package, deploy, promote, inflate, exfiltrate. The promotion stage covers social media templates and bot engagement. The inflation stage instructs operators to run a script until the extension shows 50,000 downloads, in the plan's own words to "provide social proof for developers discovering the extension". The revenue estimate runs from $10,000 to $500,000 per hour depending on whose wallet gets caught. The practical lesson is blunt: the download counter is a number the attacker controls, so it cannot be the thing that convinces you.
What to Do Now
- Check what is installed, not what you remember installing: both Solidity Pro extensions are gone from Open VSX, but removal from a marketplace does not uninstall anything already on a machine.
- Treat a hit as a full credential compromise: rotate GitHub, GitLab, AWS, Cloudflare and API keys, regenerate SSH keys, and move crypto to a wallet created on a clean device. Rotating one token is not enough when the stealer took the whole set.
- Judge the publisher, not the download count: the counter is inflated on purpose. An unfamiliar publisher with impressive numbers and a short history is the exact profile the plan describes.
- Keep seed phrases off the development machine: a hardware wallet keeps the signing keys away from anything an editor extension can reach.
- Audit extensions on a schedule: remove what you no longer use. Every installed extension runs with your permissions and updates itself quietly.
- Watch for what an editor should never do: an extension spawning
powershell,cmd,mshta,cscriptorcurlis worth an alert in any endpoint tooling you already run.
Why This Matters Beyond Developers
A developer machine is a skeleton key. The keys sitting on it open the pipelines that build software other people install, which is why this kind of theft rarely stops at the first victim. The same logic ran through the VS Code flaw where a single click handed over GitHub repositories and through the coding agents that let a GitHub issue reach CI secrets. It is also where network privacy tools stop being relevant, and saying so plainly is more useful than a sales pitch: a VPN encrypts the connection an extension makes, it does not decide whether that extension should be making it. Blocking known command-and-control domains at the DNS layer is a real, partial defence for the dropper stage, but code you installed yourself and gave your own permissions is not a network problem.
