SolanaCry: Fake GitHub Solana Starter Kit Tricks AI Coding Agents Into Installing NetSupport RAT
Researchers at AIR Research Lab disclosed SolanaCry, a campaign that uses a fake GitHub repository (SolanaUpdateTools/solana-starter-kit) posing as a Solana dApp template to target AI coding agents. The repo, created in November 2025, had 286 stars and ranked first in search results for a Solana starter kit. Its README instructs agents to run a PowerShell command that installs NetSupport Manager as a remote-access tool on Windows developer machines, potentially exposing cryptocurrency wallets.
Detalhes técnicos
- README instructs the agent to run PowerShell using Invoke-WebRequest and Invoke-Expression to fetch a 21 MB dropper, indicator.ps1, and execute it in memory (fileless).
- The script creates a hidden directory under the local application data folder and extracts 14 files: 13 legitimate, signed NetSupport Manager components (e.g. client32.exe, PCICL32.DLL) plus an attacker-supplied client32.ini.
- The configuration connects to maxwintodaybtc.com:443, hides notifications and disconnect options, beacons every 60 seconds and accepts connections from any IP.
- Persistence is established via a Registry autorun entry for client32.exe; the script clears Run dialog history and deletes the install script.
- The RADIUSSecret value in client32.ini matches eSentire's signature for EVALUSION (NetSupport delivery via ClickFix), a possible but unconfirmed link. The install command pattern also matches an October 2025 campaign documented by Fortian (fake TradingView AI-signal content and a malicious GitHub repo); developer-update.app was registered on October 20, 2025.
Remediação
Verify repository owners and installation instructions before letting coding agents execute commands or install dependencies from untrusted sources. Hunt for unexpected NetSupport Manager (client32.exe) installs and the related domain.
Linha do tempo
-
SolanaCry: Fake GitHub Solana Starter Kit Tricks AI Coding Agents Into Installing NetSupport RAT
ler a análise desta fonte ocultar
Researchers at AIR Research Lab disclosed SolanaCry, a campaign that uses a fake GitHub repository (SolanaUpdateTools/solana-starter-kit) posing as a Solana dApp template to target AI coding agents. The repo, created in November 2025, had 286 stars and ranked first in search results for a Solana starter kit. Its README instructs agents to run a PowerShell command that installs NetSupport Manager as a remote-access tool on Windows developer machines, potentially exposing cryptocurrency wallets.
Technical Details
- README instructs the agent to run PowerShell using Invoke-WebRequest and Invoke-Expression to fetch a 21 MB dropper, indicator.ps1, and execute it in memory (fileless).
- The script creates a hidden directory under the local application data folder and extracts 14 files: 13 legitimate, signed NetSupport Manager components (e.g. client32.exe, PCICL32.DLL) plus an attacker-supplied client32.ini.
- The configuration connects to maxwintodaybtc.com:443, hides notifications and disconnect options, beacons every 60 seconds and accepts connections from any IP.
- Persistence is established via a Registry autorun entry for client32.exe; the script clears Run dialog history and deletes the install script.
- The RADIUSSecret value in client32.ini matches eSentire's signature for EVALUSION (NetSupport delivery via ClickFix), a possible but unconfirmed link. The install command pattern also matches an October 2025 campaign documented by Fortian (fake TradingView AI-signal content and a malicious GitHub repo); developer-update.app was registered on October 20, 2025.
Remediation
Verify repository owners and installation instructions before letting coding agents execute commands or install dependencies from untrusted sources. Hunt for unexpected NetSupport Manager (client32.exe) installs and the related domain.