Fake Solana Starter Kit Triggers SolanaCry Malware via AI Agent

AIR Research Lab uncovered a new threat that uses a counterfeit GitHub repository to trick AI coding agents into downloading and executing a remote-access trojan. The repository, named SolanaUpdateTools/solana-starter-kit, was created in November 2025 and had 286 stars when the lab examined it. It ranks first in GitHub search results for a Solana starter kit, making it a prime target for AI agents that pull code from the platform.

The README in the fake repo instructs AI agents to run a PowerShell command that uses Invoke-WebRequest and Invoke-Expression to download a 21 MB dropper named indicator.ps1. The script runs in memory, a fileless technique that bypasses many traditional antivirus scanners. Once executed, the dropper creates a hidden directory under the user’s local application data folder and extracts 14 files, 13 of which are legitimate, digitally signed NetSupport Manager components such as client32.exe and PCICL32.DLL. An attacker-supplied client32.ini file accompanies the components.

NetSupport Manager is a legitimate remote-access tool. In this campaign, the attackers configured it to connect to a server at maxwintodaybtc.com:443. The configuration hides notifications and disconnect options from users, sends a check-in signal every 60 seconds, and allows connections from any IP address. The malware also writes client32.exe to the Windows Registry so that it starts automatically on every user login. It clears the history of commands entered through the Windows Run dialog and deletes the PowerShell script used to install the malware, further obscuring its presence.

AIR Research Lab noted that the client32.ini file contains a RADIUSSecret value that matches signature data used by eSentire to identify the EVALUSION cluster, which has previously distributed NetSupport through ClickFix campaigns. While the match does not confirm the operator, it suggests a possible link to earlier activity.

The attack pattern mirrors a 2025 campaign documented by Fortian, which used a fake TradingView AI-signal and a malicious GitHub repository to target cryptocurrency traders. That campaign registered the domain developer-update.app on October 20, 2025, and archived the payload on November 22, 2025. The SolanaCry findings also follow a trend of AI-agent exploitation, such as the June 2026 Agentjacking attacks and the July 2026 GitLost prompt injection flaw that exposed private repository data.

The SolanaCry discovery arrives amid Binance’s investigation of a DevOps engineer’s hacked laptop after a $6.3 billion theft, underscoring the vulnerability of developer machines in the crypto ecosystem.

What developers should verify

• Confirm the authenticity of any repository before feeding it to an AI agent.
• Inspect README files for unexpected PowerShell commands or download links.
• Monitor for unexpected NetSupport processes or registry entries that persist across reboots.
• Keep antivirus and endpoint detection solutions up to date, as fileless techniques can evade older signatures.

Potential impact

The malware’s use of legitimate NetSupport components and fileless execution makes it harder to detect. If an attacker gains remote access, they could exfiltrate cryptocurrency wallets stored on the infected system or manipulate development environments.

Next steps for the community

Security researchers are examining whether other AI-coding tools are vulnerable to similar injection attacks. Developers and security teams should review their AI workflows and consider sandboxing or manual vetting of external code.