Cybersecurity researchers at AIR Research Lab have discovered SolanaCry, a new malware delivered through a fake GitHub repository posing as a Solana starter kit. The repository can appear in AI coding agents‘ search results, leading them to follow instructions that install remote-access malware on developers’ Windows machines and potentially expose cryptocurrency wallets stored on those systems.
Malicious GitHub Repository Delivers NetSupport RAT
Rather than tricking developers into installing malicious software themselves, the attack targets AI agents through a malicious GitHub repository, SolanaUpdateTools/solana-starter-kit. Presented as an “open-source Solana dApp template with Anchor program, TypeScript client, and Next.js UI,” the repository was created in November 2025, had 286 stars when AIR examined it, and ranked first in search results for a Solana starter kit, researchers explained in a blog post shared with Hackread.com.
The README instructs AI agents to run a PowerShell command using Invoke-WebRequest and Invoke-Expression to download and execute a 21 MB dropper, indicator.ps1, directly in memory via fileless execution.
The script creates a hidden directory under the user’s local application data folder and extracts 14 files. These include 13 genuine, digitally signed NetSupport Manager components, including client32.exe and PCICL32.DLL, and an attacker-supplied configuration file, client32.ini.
NetSupport Manager is legitimate software that allows remote access to and management of computers. The attackers used it to connect to infected machines through a server at maxwintodaybtc.com:443. Its configuration hides notifications and disconnect options from users, sends a check-in signal every 60 seconds, and allows connections from any IP address.
The malware also adds client32.exe to the Windows Registry so that it starts automatically whenever the user logs in. It not only launches the program but also clears the history of commands entered through the Windows Run dialog and deletes the PowerShell script used to install the malware.
Links to Earlier Malware Campaigns
AIR Research Lab identified similarities between this campaign and earlier malware activity. The RADIUSSecret value inside client32.ini matches signature data that eSentire uses to identify EVALUSION, a cluster known for distributing NetSupport through ClickFix campaigns. This provides a possible link to previously tracked activity, although the match alone does not confirm who operated the campaign, researchers noted.
The installation command also follows the same pattern as one used in an October 2025 campaign documented by Fortian. That campaign used fake TradingView AI-signal content and a malicious GitHub repository to target cryptocurrency traders. The domain developer-update.app was registered on October 20, 2025, while the recovered payload was archived on November 22 that year, according to AIR’s report.
The attack follows a pattern covered in earlier Hackread.com reporting. In June 2026, researchers demonstrated Agentjacking attacks that trick AI coding agents into executing commands. In July, a GitLost prompt injection flaw showed how a crafted GitHub issue could trick an AI agent into exposing private repository data.
The SolanaCry findings also come as Binance investigates a DevOps engineer’s hacked laptop following its $6.3 billion theft, showing why developers’ computers are valuable targets for attackers seeking access to cryptocurrency infrastructure.
Given these recurring incidents, developers should exercise caution and check repository owners and installation instructions before allowing coding agents to execute commands or install dependencies from untrusted sources.
