SolanaCry: fake Solana GitHub repo lures AI coding agents, Hackread reports

What happened

Hackread reports that researchers at AIR Research Lab found malware they call SolanaCry. According to the researchers, it is delivered through a fake GitHub repository that poses as a Solana starter kit. The findings come from a single outlet, which says AIR shared its blog post with it. This advisory has no independent verification, and the number of affected developers is not confirmed.

According to Hackread, the attack is aimed at AI coding agents rather than at developers directly:

• The repository: It is named SolanaUpdateTools/solana-starter-kit and describes itself as an “open-source Solana dApp template with Anchor program, TypeScript client, and Next.js UI”.
• Visibility: AIR says it was created in November 2025, had 286 stars when examined, and ranked first in search results for a Solana starter kit.
• The install command: The README tells AI agents to run a PowerShell command that uses Invoke-WebRequest and Invoke-Expression. That command downloads and runs a 21 MB dropper, indicator.ps1, in memory.

Hackread reports the following behaviour for the script, citing AIR:

• Files: It creates a hidden directory under the user’s local application data folder and extracts 14 files. Thirteen are genuine, digitally signed NetSupport Manager components, including client32.exe and PCICL32.DLL. The fourteenth is an attacker-supplied client32.ini configuration file.
• Remote access: The configuration connects to a server at maxwintodaybtc.com:443. It hides notifications and disconnect options from the user, checks in every 60 seconds and allows connections from any IP address.
• Persistence and cleanup: It adds client32.exe to the Windows Registry so it starts at login. It then clears the Windows Run dialog history and deletes the installer script.
• Possible impact: The outlet says cryptocurrency wallets stored on infected systems could potentially be exposed.

On attribution, AIR says the RADIUSSecret value in client32.ini matches signature data that eSentire uses to identify EVALUSION. EVALUSION is a cluster known for distributing NetSupport through ClickFix campaigns. The researchers note that this match alone does not confirm who ran the campaign (Hackread).

AIR also says the install command follows the same pattern as an October 2025 campaign documented by Fortian. That campaign used fake TradingView AI-signal content and the domain developer-update.app (Hackread).

Some details are not confirmed in the source:

• whether GitHub has removed the repository
• how many machines were infected
• who operated the campaign

Am I affected?

You may be affected if all of these apply:

• You let an AI coding agent find or set up a “Solana starter kit” on a Windows machine.
• The agent used SolanaUpdateTools/solana-starter-kit.
• The agent ran the PowerShell install command from its README.

Indicators reported by Hackread:

• a hidden folder under your local application data directory containing NetSupport Manager files such as client32.exe, PCICL32.DLL and client32.ini
• a registry autostart entry that launches client32.exe at login
• network connections to maxwintodaybtc.com on port 443
• a cleared Run dialog history

The installer script deletes itself, so a missing indicator.ps1 does not show the machine is clean.

What to do now

1. Search any Windows machine where an agent may have used this repository for the indicators above. Look in particular for client32.exe and client32.ini under local application data, and for a login autostart entry pointing to client32.exe.
2. Block the domains and look for past traffic. Block maxwintodaybtc.com, and developer-update.app from the related earlier campaign, at DNS or proxy level. Check your logs for past connections to them.
3. Isolate and investigate if you find the indicators. The configuration gives remote access, so treat the machine as compromised. Move any cryptocurrency wallets and credentials that were stored on it, using a clean device.
4. Review agent instructions before execution. As Hackread advises, check repository owners and installation instructions before allowing coding agents to run commands or install dependencies from untrusted sources (Hackread). Treat README commands that pipe downloaded content into Invoke-Expression as a red flag.

Sources

• Hackread: Fake GitHub Repo Tricks AI Agents Into Installing SolanaCry Malware