Malicious 'Solidity Pro' VS Code Extensions Steal Crypto Wallets and Credentials — Detection and Removal Guide

---
title: VS Code Spawning Script Interpreter or Downloader
description: Detects the VS Code process tree spawning PowerShell, cmd, wscript, or curl/wget — consistent with a malicious extension executing a second-stage payload. Legitimate extensions rarely need to spawn script interpreters.
references:
  - https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
status: experimental
date: 2026/08/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Code.exe'
      - '\Code - Insiders.exe'
      - '\cursor.exe'
      - '\windsurf.exe'
      - '\VSCodium.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Task extensions or build tooling legitimately invoking shells from the integrated terminal
  - Investigate command lines; integrated terminal use shows interactive shell flags
level: high
---
title: Non-Browser Process Accessing Browser Credential or Wallet Stores
description: Detects processes other than the browser itself reading Chromium/Firefox credential databases or browser wallet extension storage (MetaMask and other wallet Local Extension Settings), a hallmark of stealer malware such as that dropped by the malicious solidity-pro extensions.
references:
  - https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html
  - https://attack.mitre.org/techniques/T1555/003/
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
status: experimental
date: 2026/08/01
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\'
      - '\Microsoft\Edge\User Data\'
      - '\BraveSoftware\Brave-Browser\User Data\'
      - '\Mozilla\Firefox\Profiles\'
  selection_files:
    TargetFilename|endswith:
      - '\Login Data'
      - '\Local State'
      - '\logins.json'
      - '\key4.db'
      - '\nkbihfbeogaeaoehlefnkodbefgpgknn\'
      - '\Local Extension Settings\'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
      - '\MsMpEng.exe'
  condition: selection_paths and selection_files and not filter_browsers
falsepositives:
  - EDR/AV scanning of user profile directories
  - Backup agents — exclude known backup process names after tuning
level: high
---
title: Suspicious Command Line Harvesting Secrets or Wallet Data
description: Detects command-line patterns consistent with credential and wallet theft staging — references to wallet extension IDs, browser credential files, .env files, SSH keys, or cloud credential paths in process command lines, as used by the solidity-pro stealer payload.
references:
  - https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html
  - https://attack.mitre.org/techniques/T1552/001/
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
status: experimental
date: 2026/08/01
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'nkbihfbeogaeaoehlefnkodbefgpgknn'
      - 'Local Extension Settings'
      - 'Login Data'
      - 'key4.db'
      - '\.ssh\id_'
      - '\.aws\credentials'
      - '\.env'
      - 'hardhat.config'
      - 'foundry.toml'
  condition: selection
falsepositives:
  - Developers legitimately referencing config files in build commands
  - Secret-scanning tooling (gitleaks, trufflehog) — tune by known tool image paths
level: medium

// Hunt 1: Malicious solidity-pro extension presence on endpoints
// Checks extension folders on disk and processes spawned from the extension path
let ExtIds = dynamic(["helper-beeps.solidity-pro", "web3devtoolsx.solidity-pro", "solidity-pro"]);
union isfuzzy=true
(DeviceFileEvents
| where Timestamp > ago(90d)
| where FolderPath has_any (ExtIds)
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessAccountName),
(DeviceProcessEvents
| where Timestamp > ago(90d)
| where ProcessCommandLine has_any (ExtIds) or FolderPath has_any (ExtIds)
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName)
| order by Timestamp desc;

// Hunt 2: VS Code (or OSS forks) spawning script interpreters / downloaders
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName has_any ("Code.exe", "Code - Insiders.exe", "cursor.exe", "windsurf.exe", "VSCodium.exe", "node.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "curl.exe", "wget.exe", "rundll32.exe")
| where ProcessCommandLine has_any ("http", "Invoke-", "IEX", "DownloadString", "FromBase64String", "-enc", "bypass")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, SHA256
| order by Timestamp desc;

// Hunt 3: Non-browser processes touching wallet extension storage or credential stores
DeviceFileEvents
| where Timestamp > ago(30d)
| where FolderPath has_any ("Local Extension Settings", "nkbihfbeogaeaoehlefnkodbefgpgknn")
   or (FileName in~ ("Login Data", "Local State", "logins.json", "key4.db") and FolderPath has_any ("Chrome\\User Data", "Edge\\User Data", "Brave-Browser", "Firefox\\Profiles"))
| where not(InitiatingProcessFileName has_any ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe", "MsMpEng.exe", "MsSense.exe"))
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType, FolderPath, FileName
| order by Timestamp desc;

-- Hunt: Detect solidity-pro malicious VS Code extensions and wallet-store access artifacts
-- Source: Security Arsenal — Solidity Pro VS Code extension stealer (Aug 2026)

-- Part 1: Enumerate VS Code extension directories for the malicious IDs
LET ext_hits = SELECT FullPath, Mtime, Size
FROM glob(globs=[
  'C:/Users/*/.vscode/extensions/*solidity-pro*/**',
  'C:/Users/*/.vscode-oss/extensions/*solidity-pro*/**',
  'C:/Users/*/.cursor/extensions/*solidity-pro*/**',
  'C:/Users/*/.windsurf/extensions/*solidity-pro*/**',
  '/home/*/.vscode/extensions/*solidity-pro*/**',
  '/home/*/.vscode-oss/extensions/*solidity-pro*/**'
])
WHERE FullPath =~ 'package.json|extension.js|dist|out'

-- Part 2: Processes running with VS Code parents spawning shells/downloaders
LET proc_hits = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(invoke-|iex|downloadstring|frombase64|curl |wget |certutil)'
  AND Exe =~ '(?i)(powershell|pwsh|cmd|wscript|cscript|mshta|curl|wget|rundll32)'

-- Part 3: Wallet extension storage present on disk (scope exposure per endpoint)
LET wallet_scope = SELECT FullPath
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Local Extension Settings/nkbihfbeogaeaoehlefnkodbefgpgknn/**',
  'C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Local Extension Settings/**',
  'C:/Users/*/AppData/Local/BraveSoftware/Brave-Browser/User Data/*/Local Extension Settings/**'
])
LIMIT 200

SELECT * FROM ext_hits
UNION ALL SELECT FullPath AS FullPath, NULL AS Mtime, NULL AS Size FROM wallet_scope

# Security Arsenal — solidity-pro malicious extension detection & removal
# Run per-user; extension installs live in the user profile
$maliciousIds = @('helper-beeps.solidity-pro', 'web3devtoolsx.solidity-pro')
$extRoots = @(
    "$env:USERPROFILE\.vscode\extensions",
    "$env:USERPROFILE\.vscode-insiders\extensions",
    "$env:USERPROFILE\.vscode-oss\extensions",
    "$env:USERPROFILE\.cursor\extensions",
    "$env:USERPROFILE\.windsurf\extensions"
)

$found = $false
foreach ($root in $extRoots) {
    if (-not (Test-Path $root)) { continue }
    foreach ($id in $maliciousIds) {
        $matches = Get-ChildItem -Path $root -Directory -ErrorAction SilentlyContinue |
                   Where-Object { $_.Name -like "*$id*" -or $_.Name -like '*solidity-pro*' }
        foreach ($m in $matches) {
            $found = $true
            Write-Host "[ALERT] Malicious extension found: $($m.FullName)" -ForegroundColor Red
            # Quarantine: rename before deletion for evidence preservation
            $quarantine = "$($m.FullName).QUARANTINED_$(Get-Date -Format 'yyyyMMddHHmmss')"
            Rename-Item -Path $m.FullName -NewName $quarantine -Force
            Write-Host "[INFO] Quarantined to: $quarantine — collect for IR, then delete" -ForegroundColor Yellow
        }
    }
}
if (-not $found) { Write-Host "[OK] No solidity-pro extensions found for this user." -ForegroundColor Green }

# Check for suspicious child processes spawned by editors (still-active payload)
Get-CimInstance Win32_Process |
    Where-Object { $_.ParentProcessId -in (Get-Process -Name Code,cursor,windsurf,VSCodium -ErrorAction SilentlyContinue).Id -and
                   $_.Name -match 'powershell|pwsh|cmd|wscript|cscript|mshta|curl|wget' } |
    Select-Object ProcessId, Name, CommandLine |
    Format-List

# Audit installed extensions for review (supply-chain hygiene baseline)
foreach ($root in $extRoots) {
    if (Test-Path $root) {
        Write-Host "`n=== Installed extensions in $root ===" -ForegroundColor Cyan
        Get-ChildItem $root -Directory | Select-Object -ExpandProperty Name
    }
}