Malicious Solidity Pro VS Code Extension Compromises Crypto Wallets and Credentials

Feeds.4Sysops

Malicious Solidity Pro VS Code Extension Compromises Crypto Wallets and Credentials

First seen 10 Aug 2026, 13:32 UTC • •66.0

Article Content

1 / 4

Browse articles

ThreatCluster •August 11, 2026 at 13:09 UTC

•Malicious Solidity Pro extension targets developers, stealing crypto wallets and credentials.
•The extension employed delayed activation to avoid detection during initial reviews.
•Related GitHub repository remains accessible, continuing the risk for developers.

A malicious VS Code extension named Solidity Pro has been discovered stealing sensitive data from developers, including cryptocurrency wallets, API keys, and SSH keys. The extension utilized delayed activation and obfuscation techniques to evade detection before executing its theft. Affected users are primarily developers working with Solidity, a programming language for Ethereum smart contracts. Although the malicious extensions have been removed from Open VSX, a related GitHub repository remains accessible, posing ongoing risks. This incident highlights the vulnerabilities in trusted development environments and the potential for significant data loss. Developers are advised to remain vigilant and review their installed extensions for any suspicious activity.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 62d ago How this analysis works

Timeline

2026-08-10

Malicious extension discovered

The Solidity Pro VS Code extension was found to be stealing sensitive data from developers.

Cybersecuritynews

2026-08-10

Extension removed from Open VSX

The malicious extensions were taken down from the Open VSX marketplace following the discovery.

More articles in this cluster (3)

Threat Graph

8 entities, 9 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Malware
Supply Chain Attack
T1041 - Exfiltration Over C2 Channel
T1195 - Supply Chain Compromise

Organization (1)

Open VSX

Malware (1)

Solidity Pro

Affected Platform (2)

Visual Studio Code
Telegram

Relationships

Solidity Pro targets Open VSX
Malware targets Visual Studio Code
Malware targets Telegram
Supply Chain Attack targets Visual Studio Code
Supply Chain Attack targets Telegram
T1041 - Exfiltration Over C2 Channel targets Visual Studio Code
T1041 - Exfiltration Over C2 Channel targets Telegram
T1195 - Supply Chain Compromise targets Visual Studio Code
T1195 - Supply Chain Compromise targets Telegram

Following this threat?

Track Solidity Pro and Open VSX in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…