al-ice.ai

The Starter Kit Was the Loader: SolanaCry Turned Agent Search Results Into a NetSupport Install Path

Agent & Supply Chain Security by al-ice.ai Editorial

AIR Research Lab disclosed SolanaCry on 29 October 2026: a fake GitHub repository posing as a Solana starter kit that ranks as the top result when an AI coding agent searches for one, and whose README’s only installation step is a malicious PowerShell one-liner. Follow it and the agent installs a remote access trojan on the developer’s Windows machine — including any crypto wallets on it — without the developer ever inspecting the repository or the commands. The malware and techniques are not new. The path to the victim is: instead of convincing a developer to download and run something malicious, the operators targeted the agents developers trust to search the web, pick dependencies and set up projects.

The repository

The repo is SolanaUpdateTools/solana-starter-kit, created in November 2025, holding 286 stars when AIR examined it, and self-described as an “open-source Solana dApp template with Anchor program, TypeScript client, and Next.js UI.” None of that code exists. Its README promises a full app template; the actual content is a single instruction telling the reader — human or agent — to run a PowerShell command that builds its URL from fragments ($update + $mode + $key + '.app/update/' + $file, reconstructing to developer-update.app/update/indicator), downloads the payload with iwr and executes it in memory with iex. Textbook fileless execution: nothing touches disk at the delivery stage. The live payload URL returned 404 when checked, so AIR recovered the 21 MB dropper, indicator.ps1 (SHA-256 41902d18…680a201d), from the Web Archive — a recovery BleepingComputer independently repeated and confirmed.

Fourteen files, thirteen of them legitimate

The dropper creates a hidden staging directory under %LOCALAPPDATA% and decodes 14 embedded base64 files: 13 genuine, digitally signed NetSupport Manager v12.10 components (client32.exe, PCICL32.DLL, transport and control DLLs, an audio recorder, a remote command shell, a C++ runtime, license and driver files) plus one attacker-supplied configuration file, client32.ini. NetSupport Manager is legitimate commercial remote-administration software — screen viewing and control, keyboard and mouse, file transfer, remote shell, audio capture, registry access, user enumeration — and the attacker wrote none of it. The single config file does all the weaponizing: it points the gateway at maxwintodaybtc.com:443, disables every user-facing warning and disconnect option, accepts operators from any IP address, and sets a 60-second heartbeat. Persistence follows through an auto-start Registry entry, and the dropper then clears the Run-dialog history and deletes itself. Living off signed binaries is the point: nothing the endpoint sees is “malware” except the config and the behavior.

An old operator with a new audience

AIR links the tradecraft, carefully, to known activity. The RADIUSSecret value in the attacker’s config matches signature data eSentire uses to identify EVALUSION, the most active NetSupport cluster it tracks across ClickFix campaigns — a possible link to previously tracked activity, not an attribution, as AIR notes. The install one-liner follows the same fragment-built pattern Fortian documented in October 2025, when fake TradingView “AI signal” videos pointed at a GitHub repo and the same $update/$mode/$key/$file construction fetched from a lookalike .app domain. The infrastructure timeline fits one operator iterating: developer-update.app registered 20 October 2025, the Solana repo created that November, the payload archived 22 November. First traders, then developers — and now the AI agents working for them. AIR reports no victim counts, and the C2 domain’s current state is unconfirmed; treat the indicators as hunting leads, not a closed case.

The developer may never see the repository

That is the line that makes SolanaCry an agent-security story rather than another fake-repo story. The attack chain AIR describes — developer asks agent to build a Solana project, agent searches the web, agent picks the top-ranked repo, agent follows the README — never requires a human to open the repo page. It is the same delivery-shape shift behind the Agentjacking demonstrations that steered coding agents into executing commands, the planted AGENTS.md that drove Codex into installing malware from the Downloads folder, the GitLost prompt-injection path into private repositories, and the trojanized Claude Code build that rode Cursor’s own marketplace. Each moves the trust decision from the developer to the agent, and each is caught at the same place: the moment before the agent runs something. SolanaCry also lands against an expensive backdrop — AIR and HackRead note the industry attention on developers’ machines as crypto targets while Binance investigates a DevOps engineer’s hacked laptop amid its $6.3 billion theft — which explains why wallets, not just shells, are the prize.

What to actually do

  1. Require explicit approval before agents run iwr | iex / curl | sh one-liners from any repository, and before they add new MCP servers, configs or base URLs. The README command is the whole attack.
  2. Verify repository provenance before the agent executes anything: owner history, star growth, whether the advertised code actually exists. 286 stars on a template with no template code is the tell.
  3. Hunt Windows developer machines for the campaign’s residue: hidden directories under %LOCALAPPDATA%, a SecureModule Run key, NetSupport components where no IT team installed them, and wiped RunMRU history. Block maxwintodaybtc.com at DNS and egress.
  4. Treat agent web search as an untrusted input channel end to end — the same posture as hijacked assistant configs. Rank, stars and README polish are attacker-controlled.

Our verification was read-only. We read the full AIR Research Lab SolanaCry report first-hand (Eliad Mualem, Dor Granat, published 29 October 2026: repository identity, 286-star and November-2025 creation details, fragment-built one-liner and reconstructed URL, indicator.ps1 size and SHA-256, 14-file inventory, client32.ini contents, persistence and cleanup steps, RADIUSSecret/EVALUSION linkage caveat, Fortian October-2025 parallel), the full HackRead write-up (Deeba Ahmed, 30 October 2026) and the BleepingComputer coverage including its independent Wayback payload confirmation first-hand. No victim counts were reported by any source; the Binance-theft backdrop is industry context from the secondary coverage, not a claimed connection. We cloned nothing, ran nothing, resolved no C2, and contacted no vendor. Brave Search was used for discovery only.

Sources: