<\/p>\n
Security researchers have found open-source packages<\/a> targeting developers with malware that steals cryptocurrency. The packages were hosted on the Open VSX repository disguised as tools for working with Solidity, a programming language used in blockchain development. They delivered malware that gave attackers control over victims\u2019 devices and access to sensitive data.<\/p>\n The packages were meant to work with Cursor, a development environment based on Visual Studio Code. Cursor is often used for AI-assisted coding, making it a natural target for attackers looking to reach developers.<\/p>\n Kaspersky\u2019s Global Research and Analysis Team uncovered the issue after a Russian blockchain developer reported an incident. The developer had installed what looked like a regular Solidity extension. Instead, it gave hackers access to his computer. They used that access to steal around $500,000 in cryptocurrency.<\/p>\n The attackers made their fake extension appear more trustworthy by pushing it higher in the repository\u2019s search results by spoofing download numbers \u2013 pegging it at 54,000 installs. After being installed, the extension didn\u2019t do anything useful. Instead, it installed ScreenConnect, a remote access tool that gave attackers full control of the machine.<\/p>\n From there, the attackers deployed Quasar, an open-source backdoor, along with a stealer tool. The combination collected data from the victim\u2019s web browsers, email apps, and cryptocurrency wallets, including wallet seed phrases \u2013 critical information that allowed the attackers to drain accounts.<\/p>\n Once the original malicious extension was taken down, the attacker reuploaded it and faked more installs \u2013 this time claiming two million downloads (the real version of the extension had around 61,000 downloads by comparison). Kaspersky has flagged the fake version again for removal.<\/p>\n Georgy Kucherin, a researcher at Kaspersky, said these kinds of attacks are getting harder to spot. Even experienced developers who understand cybersecurity risks can fall for them, especially in fields like blockchain.<\/p>\n In addition to the fake Solidity extension, the attacker uploaded a malicious NPM package called The attacks highlight how public code repositories are a growing threat vector, especially for developers working in sensitive fields like cryptocurrencies. Malicious packages disguised as helpful tools are proving to be a simple but effective way for attackers to gain access to high-value targets.<\/p>\n See also: Bitcoin\u2019s rise puts cloud mining back on the table<\/a><\/strong><\/p>\nsolsafe<\/code>, which also delivered ScreenConnect. A few months before that, three other harmful Visual Studio Code extensions \u2013 solaibot<\/code>, among-eth<\/code>, and blankebesxstnion<\/code> \u2013 were uploaded to the same repository. Those have since been removed.<\/p>\n