StepSecurity Finds Backdoor in IoliteLabs Solidity VS Code Extensions

Mar 27, 2026 · Original article ↗

Summary

StepSecurity says three dormant IoliteLabs Solidity VS Code extensions were updated with a startup backdoor delivering Windows and macOS payloads. They had about 27,500 combined installs; the current dropper has no Linux handler.

Key points

StepSecurity reports that three IoliteLabs Solidity extensions were updated to version 0.1.8 on March 25, 2026, after being dormant since 2018; their combined Marketplace install count was about 27,500.
The report says the public source repository had no corresponding update, which it identifies as a strong signal that the established publisher account was compromised.
The backdoor was injected into the bundled pako dependency and uses Unicode escapes, bracket notation, junk arithmetic, a reversed platform string, and dependency hiding. The onStartupFinished event triggers code on VS Code startup.
On Windows, the chain downloads a batch file from rraghh[.]com and a Chrome-impersonating MSI from oortt[.]com. The MSI installs a DLL using regsvr32 and creates persistence; export names suggest input monitoring, but the report says the DLL’s behavior could not be confirmed from those names alone.
On macOS, payloads for Intel and Apple Silicon are downloaded from cdn.rraghh[.]com. The scripts remove quarantine attributes and set up a LaunchAgent for login persistence.
The current dropper handles Windows and macOS, but the report found no Linux payload branch.
The article provides indicators and removal steps, including uninstalling the extensions, checking for persistence artifacts, auditing network logs, and rotating potentially exposed credentials.

Article Details

Attack Vectors: An attacker-controlled IoliteLabs publisher account was used to push malicious version 0.1.8 updates to three dormant VSCode extensions targeting Solidity developers.
The extensions execute injected JavaScript in a tampered pako dependency on VSCode startup. The code uses obfuscated strings and detached curl commands to retrieve platform-specific payloads.
On Windows, a batch dropper downloads a Chrome-impersonating MSI. The installer uses regsvr32 to load a DLL and creates a registry persistence key; its hook-related exports suggest input monitoring, but the DLL's behavior could not be confirmed.
On macOS, a shell script downloads and runs separate Intel and Apple Silicon binaries, installs a LaunchAgent for login persistence, and removes quarantine attributes before execution.
The article describes the macOS binaries' embedded modules as consistent with file archiving and multipart uploads, but does not confirm their actual collection or exfiltration behavior.
Defensive Notes: Uninstall the affected solidity-macos, solidity-windows, and solidity-linux extensions at version 0.1.8 and check machines where they were installed.
On macOS, check for and remove the listed LaunchAgent, hidden launcher, downloaded binaries, and PATH modifications. On Windows, check for the ChromeUpdate directory, registry key, batch file, and MSI.
Audit DNS and firewall logs for rraghh.com, cdn.rraghh.com, and oortt.com.
If an affected extension ran, treat relevant wallet keys, seed phrases, SSH keys, API keys, browser credentials, and development tokens as potentially compromised and rotate them.
Review bundled extension dependencies, not just the declared entry point, and scrutinize unexpected startup activation events.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`cdn[.]rraghh[.]com`	Attacker-controlled domain serving the macOS dropper and stage-2 binaries.
DOMAIN	`oortt[.]com`	Attacker-controlled domain used to deliver the Windows MSI.
DOMAIN	`rraghh[.]com`	Attacker-controlled domain serving the Windows stage-1 dropper.
SHA256	`38cb0e1209a721a565e71f9dc0593437723dc32c4d2fe2d23de141f4d306ccea`	SHA-256 of the malicious Intel macOS stage-2 binary.
SHA256	`40a6bbc8260bc17faa583dd3c3954a0e3c4b0abb923baaecd2ad7901311d5d82`	SHA-256 of the malicious Windows calc.bat dropper.
SHA256	`5886a9b659c05fb3e3077c80bb6a8be6acb1064683db542fae90e3bf9757f95f`	SHA-256 of the malicious macOS doc.sh dropper.
SHA256	`5f9c09c2c432a6b94f2200455065bcfd1237f8a01b913a7c9e37f164ff99a84c`	SHA-256 of the ntuser DLL extracted from the malicious MSI.
SHA256	`8e7213940a2f590af145226d22a96d416bcca4bc6cba3400a8a96fd3e7018080`	SHA-256 of the malicious Apple Silicon macOS stage-2 binary.
SHA256	`e0f206aac2c3fa733b0c466d2ebb86ba038cf1fe2edeee21e94a4d943a27f63b`	SHA-256 of the malicious solidity-macos VSIX version 0.1.8.
SHA256	`e903ae267bf7ed1d02b218c1dc7cf6d87257e87de9fbda411a13f9154716bfa3`	SHA-256 of the malicious Windows 7WhiteSmoke.msi installer.
SHA256	`fcd398abc51fd16e8bc93ef8d88a23d7dec28081b6dfce4b933020322a610508`	SHA-256 of the tampered pako/index.js file containing the injected code.
URL	`hxxps[:]//cdn[.]rraghh[.]com/gt/doc`	Malicious Intel macOS binary download URL.
URL	`hxxps[:]//cdn[.]rraghh[.]com/gt/doc.sh`	Malicious macOS shell dropper URL.
URL	`hxxps[:]//cdn[.]rraghh[.]com/gt/doc1`	Malicious Apple Silicon macOS binary download URL.
URL	`hxxps[:]//rraghh[.]com/gt/calc.bat`	Malicious Windows batch dropper URL.