Threat Intelligence

Fake VS Code Extension 'Solidity Pro' Caught Stealing Crypto Wallets and Credentials

The Hacker News · 10 Aug 2026

Key Takeaway Only install VS Code extensions from verified publishers, and regularly audit installed extensions on developer machines to catch suspicious or unused tools.

Security researchers have uncovered a malicious Visual Studio Code extension called "Solidity Pro" that secretly steals sensitive data from developers who install it. The extension, distributed under names such as helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, was designed to look like a legitimate tool for Solidity smart contract development but instead functioned as a credential and wallet stealer, targeting browser-based cryptocurrency wallets, API keys, and login details.

Both versions of the extension have since been removed from the Open VSX marketplace, though related code was found hosted on GitHub. This incident highlights a growing trend of attackers using trusted developer tool marketplaces to distribute malware, exploiting the fact that many developers install extensions without closely scrutinising their source or permissions.

For Australian small businesses that employ developers or contract freelance coders—particularly those working with blockchain, smart contracts, or web3 applications—this is a reminder that developer tools themselves can be an attack vector. Malicious extensions can quietly exfiltrate business credentials, API keys, and financial assets before anyone notices.

software-supply-chain credential-theft cryptocurrency developer-security malware

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.