Case cursor-solidity-extension-theftAI supply chainRussia
Fake 'Solidity Language' extension on Open VSX drains $500K from Cursor developer
A spoofed Solidity extension on Open VSX, ranked above the real one through inflated downloads, ran a PowerShell script that installed ScreenConnect, Quasar RAT and a stealer, letting attackers take a developer's seed phrases and about 500,000 dollars in crypto.
HighAttack on AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 10, 2025
- Location
- Russia
- Target
- Cursor IDE users installing Solidity extensions
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Criminal
- Reported loss
- $500K
- CVE
- None
What happened
A spoofed Solidity extension on Open VSX, ranked above the real one through inflated downloads, ran a PowerShell script that installed ScreenConnect, Quasar RAT and a stealer, letting attackers take a developer's seed phrases and about 500,000 dollars in crypto.
Impact: About 500,000 dollars in cryptocurrency stolen from one developer; the extension had tens of thousands of claimed installs, so additional victims are possible
Who triggered it
Actor: Unknown
Attribution: Unattributed; Kaspersky later linked related extensions (solaibot, among-eth, blankebesxstnion) and the npm package solsafe; Koi Security tied the activity to the WhiteCobra crew in September 2025
Motive: Cryptocurrency theft
How it happened
Attack vector: Malicious VSIX extension in the Open VSX registry used by Cursor, with download counts inflated to 54,000 and later 2 million to outrank the legitimate extension
Root cause: AI editors rely on Open VSX, which lacks the vetting of the Visual Studio Marketplace, and ranking can be gamed with fake install counts
Timeline
- Russian blockchain developer asks Kaspersky to investigate after losing crypto
- Open VSX removes 'Solidity Language' after Kaspersky's report
- Attacker republishes a near-identical 'solidity' extension with an inflated install count
- Kaspersky publishes findings and requests removal of the second extension
Response
Open VSX removed the extensions on request; Kaspersky published IOCs and warned Cursor and Windsurf users about unvetted marketplace extensions
Current status: Contained
Sources (open in a new tab)
- Kaspersky kaspersky.com
- BleepingComputer bleepingcomputer.com
- SC World scworld.com
Cite this case
Fake 'Solidity Language' extension on Open VSX drains $500K from Cursor developer. AI Threat Watch, case cursor-solidity-extension-theft, Jul 10, 2025. https://aithreat.io/cases/cursor-solidity-extension-theft/
Permanent link: https://aithreat.io/cases/cursor-solidity-extension-theft/