Malicious VS Code Extensions “Solidity Pro” Harvest Crypto Wallets, API Keys, and Developer Credentials
What Happened — Researchers discovered two malicious Microsoft Visual Studio Code extensions, helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, that install a hidden browser‑wallet and credential‑stealer. The extensions target developers working with Solidity and can exfiltrate crypto private keys, API tokens, and other sensitive credentials.
Why It Matters for Compliance & Audit Readiness
- Credential‑theft via a third‑party development tool is a classic “access control” failure that SOC 2 CC 6.1 (Logical Access) is designed to prevent and evidence.
- Continuous monitoring of approved software inventories and documented security‑awareness training provide the audit‑ready proof points needed to demonstrate due diligence.
Who Is Affected — SaaS and fintech developers, blockchain teams, and any organization that allows unrestricted VS Code extensions (Technology / SaaS, Financial Services).
Recommended Actions
- Enforce a whitelist of approved VS Code extensions and block unsigned marketplace items.
- Conduct a rapid inventory of installed extensions across all developer workstations.
- Update your SOC 2 access‑control policies to require multi‑factor authentication for any wallet or API‑key usage.
- Reinforce security‑awareness training focused on supply‑chain risks of developer tools.
- Deploy endpoint monitoring to detect anomalous credential‑exfiltration traffic.
Source: The Hacker News
Technical Notes — The malicious extensions are delivered via the Open VSX marketplace (now removed) and embed a JavaScript payload that captures window.ethereum objects, reads browser‑stored private keys, and forwards them to a remote C2 server. No CVE is associated; the threat vector is a supply‑chain compromise of a third‑party IDE plugin.