Malicious Solidity Pro Extension Spreads Malware to Crypto Developers

Crypto developers using Visual Studio Code for smart contract work have been targeted by a malicious extension called 'Solidity Pro'. The extension, which promises Solidity development support and AI-powered auditing features, has been found to quietly download additional payloads, harvest sensitive developer data, and transmit it to servers controlled by the attackers. This is not an isolated incident, as similar attacks on developer tooling have become a recurring threat in the crypto and Web3 space.

According to researchers at Yeeth Security, the malicious extension uses a multi-stage attack that starts with a normal-looking coding tool and ends with independent Python malware operating on the victim's machine. The extension waits for a randomized delay of 12 to 72 hours before reaching out to Cloudflare Worker endpoints, which then respond with a payload encrypted using AES-GCM.

The most consequential technical detail is that this spawned process is detached, meaning it keeps running independently of the VS Code extension host even after the editor has been closed. This makes it difficult for developers to identify and remove the malware, as simply uninstalling the extension does not stop its operation.