Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

A malicious Visual Studio Code extension named 'solidity-pro' has been identified as stealing cryptocurrency wallets, API keys, and credentials from developers. The threat delivers a browser wallet and credential stealer that exfiltrates sensitive data such as mnemonic phrases, SSH keys, GitHub tokens, AWS keys, and Telegram bot tokens via Telegram bots. The malware uses heavy obfuscation, delayed activation, and clean intermediate versions to evade detection by static scanners and sandbox environments.

AI-extracted · verify before operational use