Affected Systems

Microsoft Visual Studio Code users who installed "Solidity Pro" extensions (helper-beeps.solidity-pro or web3devtoolsx.solidity-pro) from Open VSX marketplace. Extensions targeted Ethereum/Web3 developers. Versions 1.0.0-2.4.x beaconed to C2; v3.0.0+ deployed full information stealer. Extensions now removed from Open VSX but GitHub repository remains accessible.

Exploitation Status

Active exploitation confirmed. Malicious extensions were live on Open VSX marketplace and successfully distributed to developers. Extensions used delayed activation (hours to days post-install) to evade detection. Exfiltration via Telegram bot confirmed. Similar to WhiteCobra campaign from September 2025.

Business Impact

Development teams using VS Code face credential theft, API key compromise, and cryptocurrency wallet loss. Stolen assets include GitHub/GitLab tokens, AWS keys, OpenAI API keys, SSH private keys, MetaMask/Phantom/Coinbase wallet vaults, seed phrases, and Telegram bot tokens. Delayed activation means infected systems may remain compromised for days before detection. Supply chain risk extends to any code repositories or cloud infrastructure accessed with stolen credentials.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit all VS Code installations for helper-beeps.solidity-pro and web3devtoolsx.solidity-pro extensions and remove if present
  • Rotate all GitHub tokens (ghp_, github_pat_), GitLab tokens (glpat-), AWS keys, Cloudflare tokens (cfat_), OpenAI keys, and SSH keys on systems where these extensions were installed
  • Review cryptocurrency wallet activity for unauthorized transactions; transfer funds from potentially compromised wallets (MetaMask, Phantom, Rabby, Coinbase, Trust, Keplr) to new wallets with fresh seed phrases
  • Block known C2 domains at network perimeter and monitor for outbound connections to Cloudflare Workers endpoints and Telegram bot API traffic from developer workstations
  • Enable EDR alerting on cscript.exe, mshta.exe, cmd.exe, curl.exe, and powershell.exe execution from VS Code extension directories (%USERPROFILE%\.vscode\extensions)