Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro ("solidity-pro") that has been observed delivering a browser wallet and credential stealer. Subsequent versions starting with v3.0.0, on the other hand, have shifted to a full-blown information stealer that can collect browser profiles, crypto wallets, source-control tokens, API keys, SSH keys, and Telegram bot tokens. The cybersecurity company said the activity shares the same high-level playbook as WhiteCobra, another threat cluster that was detected in September 2025 as distributing Lumma Stealer through malicious VS Code extensions. "When a recognized crypto address is on the clipboard, it replaces the pasted value with an attacker-controlled address," it added. A VS Code extension named "Zlmiles.zlmiles-liquid" (now removed from the VS Marketplace) that makes use of a suspected builder kit to drop an MSI installer hosted on a Replit domain.