Threat
Fake GitHub Repo Tricks AI Agents Into Installing SolanaCry Malware
First reported · Discovered hackread.com
Page published · Page updated
Earliest dated coverage: 30 Oct 2026 · First observed: 10 Nov 2026 · Latest dated coverage: 30 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
SolanaCry shows how attacker-controlled repository instructions can turn an AI coding agent’s development workflow into malware execution and persistent remote access on a developer endpoint.
AIR Research Lab reports that SolanaCry uses the malicious GitHub repository SolanaUpdateTools/solana-starter-kit to lure AI coding agents into executing a PowerShell malware installer. The installer deploys legitimate NetSupport Manager components with attacker-controlled configuration, enabling concealed remote access and persistence on developers’ Windows machines.
Summary
Hackread reports that AIR Research Lab identified SolanaCry, a malware-delivery operation using the GitHub repository SolanaUpdateTools/solana-starter-kit to influence AI coding agents. The repository presented itself as an open-source Solana application template. Its README directed agents to execute a PowerShell installation command, turning repository-supplied instructions into a route for deploying remote-access software on Windows developer systems.[0]
The reported installer, indicator.ps1, deployed legitimate, digitally signed NetSupport Manager components alongside an attacker-controlled configuration. That configuration enabled concealed remote access through maxwintodaybtc.com on port 443, with 60-second check-ins. The malware also established user-logon persistence, cleared Windows Run-dialog history, and deleted its installation script. The use of signed remote-management software makes the surrounding configuration, persistence, and network activity important to distinguishing this deployment from authorized administration.[0]
Attribution remains unresolved. A configuration-secret match suggests a possible relationship to EVALUSION, while an installation-command pattern resembles an earlier campaign documented by Fortian; neither establishes a common operator. This dossier relies on the single supplied Hackread report summarizing AIR's findings. The report does not establish a victim count or confirmed cryptocurrency theft, and describes wallet exposure as a potential consequence of endpoint access.[0]
Attack chain
- Repository lure and discovery: The attacker-controlled SolanaUpdateTools/solana-starter-kit repository posed as an open-source template containing an Anchor program, TypeScript client, and Next.js interface. It reportedly had 286 stars and ranked first for a Solana starter-kit search when AIR examined it, placing the malicious instructions in a location an AI coding agent could encounter while selecting development resources.[0]
- README-directed PowerShell execution: The README instructed AI agents to run PowerShell using Invoke-WebRequest and Invoke-Expression to download and execute the reported 21 MB indicator.ps1 dropper in memory. The delivery mechanism relied on the agent acting on instructions embedded in an untrusted repository.[0]
- Remote-access payload deployment: The script created a hidden directory beneath the user's local application data folder and extracted 14 files: 13 genuine, digitally signed NetSupport Manager components, including client32.exe and PCICL32.DLL, plus the attacker-supplied client32.ini configuration.[0]
- Persistence, launch, and cleanup: The installer reportedly added client32.exe to the Windows Registry for automatic execution at user logon and launched the program. It also cleared command history from the Windows Run dialog and deleted the PowerShell installation script. The article does not specify the exact registry key or hidden-directory name.[0]
- Concealed remote access: The deployed NetSupport configuration directed connections through maxwintodaybtc.com on port 443, sent check-ins every 60 seconds, hid user notifications and disconnect options, and allowed connections from any IP address. The report identifies remote access as the resulting capability but does not document subsequent wallet theft or other post-compromise operations.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2025-10-20 | According to the AIR findings summarized by Hackread, developer-update.app was registered. The supplied article does not specify the domain's precise operational role.[0] |
| 2025-11 | The malicious SolanaUpdateTools/solana-starter-kit repository was reportedly created. No day of creation is supplied.[0] |
| 2025-11-22 | The recovered payload was reportedly archived. This is an artifact-history date, not an established infection date.[0] |
| 2026-10-30 | Hackread published its account of AIR Research Lab's SolanaCry findings.[0] |
Actor profile
EVALUSION
EVALUSION is a possible related activity cluster, not the confirmed operator of SolanaCry. The report describes it as distributing NetSupport through ClickFix campaigns. AIR reportedly found that the RADIUSSecret value in SolanaCry's client32.ini matched signature data used by eSentire to identify EVALUSION, while explicitly cautioning that this match alone does not establish attribution.[0]
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| domain | maxwintodaybtc.com | Reported remote-access server used by the malicious NetSupport deployment on port 443. The associated configuration checked in every 60 seconds.[0] |
| domain | developer-update.app | Domain identified in the reported SolanaCry analysis, with a registration date of October 20, 2025. Its precise operational role is not specified in the supplied article; treat it as a contextual hunt lead rather than standalone proof of compromise.[0] |
| other | SolanaUpdateTools/solana-starter-kit | Exact owner/repository identifier of the reported malicious GitHub lure. Useful for reviewing coding-agent browsing, repository-selection, and command-execution records.[0] |
| file-path | indicator.ps1 | Filename of the reported 21 MB PowerShell dropper. No full path or cryptographic hash is supplied; correlate the name with the repository lure, PowerShell execution, and subsequent NetSupport deployment.[0] |
Key takeaways
- The reported intrusion route was agent execution of malicious repository instructions, not exploitation of a specified software vulnerability. Repository popularity and search placement were part of the lure, not evidence that its installation commands were trustworthy.[0]
- The remote-access payload used legitimate, signed NetSupport components. Detection should therefore connect the binaries to unauthorized configuration, hidden staging, logon persistence, and the reported remote-access destination.[0]
- Keep attribution and impact bounded: the EVALUSION link is tentative, and potential wallet exposure should not be reported as confirmed cryptocurrency theft.[0]
Defensive actions
- Review the repository owner and installation instructions before permitting an AI coding agent to execute commands or install dependencies from the repository.: The reported entry point was a repository README that instructed agents to execute the malware installer. The article specifically recommends checking ownership and installation instructions before allowing execution from untrusted sources.[0]
- Require human review of repository-provided PowerShell download-and-execute instructions, particularly commands combining Invoke-WebRequest and Invoke-Expression.: That command combination was the reported mechanism for retrieving and executing indicator.ps1 in memory. Reviewing the requested command addresses the specific transition from untrusted repository content to endpoint execution.[0]
- Search available coding-agent records and PowerShell telemetry for the malicious repository identifier, indicator.ps1, and the reported download-and-execute pattern.: These artifacts connect repository discovery to installer execution. The installer reportedly deleted its script and cleared Run-dialog history, so the absence of those local artifacts alone would not exclude execution.[0]
- Hunt for unexpected NetSupport installations in hidden directories beneath user-local application data, then inspect their client32.ini configuration and logon-start registry entries.: The reported deployment combined client32.exe and PCICL32.DLL with an attacker-supplied configuration and registry-based logon persistence. Because the binaries were genuine and signed, their presence alone is insufficient to identify this malicious deployment.[0]
- Monitor for and block unauthorized endpoint connections to maxwintodaybtc.com on port 443, and correlate matches with NetSupport execution and approximately 60-second check-ins.: The article identifies this destination, port, and check-in interval as properties of the attacker's remote-access configuration. Correlation with the host artifacts provides stronger evidence than a filename-only match.[0]