Fake Solidity Pro Extensions Turn Trusted Developer Tooling Into Credential

Gbhackers •Mayura Kathir • August 10, 2026

Malicious “Solidity Pro” extensions are abusing the trust developers place in VS Code and Open VSX tooling, evolving from delayed payload droppers into broad credential and cryptocurrency-wallet stealers. Yeeth Security identified two publishers, helper-beeps and web3devtoolsx, distributing related solidity-pro packages that use Solidity-themed branding, obfuscation, and version churn to target web3 developers. The campaign reflects […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious Solidity Pro VS Code Extension Compromises Crypto Wallets and Credentials A malicious VS Code extension named Solidity Pro has been discovered stealing sensitive data from developers, including cryptocurrency wallets, API keys, and SSH keys. The extension utilized delayed activation and obfuscation techniques to evade detection before executing its theft. Affected users are primarily developers working with Solidity, a programming language for Ethereum smart contracts. Although the malicious extensions have been removed from Open VSX, a related GitHub repository remains accessible, posing ongoing risks. This incident highlights the vulnerabilities in trusted development environments and the potential for significant data loss. Developers are advised to remain vigilant and review their installed extensions for any suspicious activity. 3 sources 66

Extracted Entities

Fake Solidity Pro Extensions Turn Trusted Developer Tooling Into Credential

The full story

Extracted Entities

Attack Types (2)

Companies (1)

MITRE ATT&CK (1)