Exfiltration is executed through a Telegram bot, with heavy obfuscation and delayed activation to evade detection, including splitting strings across IIFE tables and shuffling method names across releases.

A malicious Visual Studio Code extension named Solidity Pro (solidity-pro) has been observed delivering a credential and crypto wallet stealer, and it is linked to two other extension aliases: helper-beeps.solidity-pro and web3devtoolsx.solidity-pro.

The malware harvests a wide range of data, including GitHub and GitLab tokens, AWS keys and session tokens, Cloudflare and OpenAI tokens, Telegram bot tokens, mnemonic seed phrases, and wallets from major providers, along with Bitcoin WIF/xprv, SSH private keys, and URL credentials such as 1Password MFA tokens.

Users who installed these extensions should remove them, audit their dependency graphs, block known command-and-control domains, and monitor for indicators such as the use of commands like cscript, mshta, cmd, curl, and powershell.

Early versions (1.0.0 to 2.x) beaconed to Cloudflare Workers to fetch an encrypted Python payload; from version 3.0.0 onward, the extension acts as an information stealer targeting browser profiles, crypto wallets, tokens, keys, and credentials.

The broader threat ecosystem includes an npm dropper package, Windows-based dropper extensions, and the DigitalBarberTrim extension that drops a remote VSIX after enumerating VS Code forks, signaling wider ecosystem risk.

The attack pattern mirrors the WhiteCobra cluster and represents a broader trend of rogue Solidity extensions and dropper packages targeting developers and crypto users.