← All incidents

AIR Research Lab says a fake Solana starter kit on GitHub was aimed at AI coding agents and delivered the NetSupport remote-access tool; BleepingComputer confirmed the payload

Incident · GitHub repository SolanaUpdateTools/solana-starter-kit (fake Solana starter kit; Windows PowerShell payload, per AIR Research Lab) · MEDIUM

Summary

AIR Research Lab, the research team at Air Security, says a GitHub repository posing as a Solana starter kit, SolanaUpdateTools/solana-starter-kit, "ranks as the top result when an agent searches for one" and "contains malware that gives an attacker remote control of the victim's machine, including the crypto wallets on it." AIR calls it SolanaCry. Per AIR, the repository was created in November 2025, had 286 stars, and its README's only "installation" step is a PowerShell one-liner that downloads a script from developer-update.app and runs it in memory. AIR says the script drops genuine, signed NetSupport Manager files with an attacker's configuration pointing to maxwintodaybtc.com, and adds a Run key so the remote-access client starts at every login. BleepingComputer independently checked the malware: it "obtained the archived payload from the Internet Archive's Wayback Machine and confirmed Air's findings." The claim that AI agents pick this repository comes from AIR alone. AIR's write-up does not name the agent product it tested, though its post includes an animated demo of an agent session picking the repository. Neither AIR nor BleepingComputer reports a confirmed victim. We found no statement from GitHub. The repository was still live when BleepingComputer wrote about it on Oct 29; when we checked at 10:37 a.m. ET on Oct 31, it and the SolanaUpdateTools account returned 404 on GitHub. GitHub has not said whether it removed them.

Severity

Timeline

1. Oct 20, 2025
   Per AIR, the payload domain developer-update.app is registered.
2. November 2025
   Per AIR, the SolanaUpdateTools/solana-starter-kit repository is created on GitHub. AIR says the payload it recovered was archived on Nov 22.
3. Oct 29, 2026
   AIR Research Lab publishes "SolanaCry: Malware in the wild steals crypto wallets from web-browsing AI agents".
4. Oct 29, 2026, 6:09 p.m. ET
   BleepingComputer reports on the repository in an article mainly about a separate Hugging Face campaign. It says it "obtained the archived payload from the Internet Archive's Wayback Machine and confirmed Air's findings," and that "At the time of writing, the GitHub repository was still live."
5. Oct 31, 2026, 10:37 a.m. ET
   We check GitHub: the repository page, its API record, the SolanaUpdateTools account page and its API record all return 404.
6. Oct 31, 2026, 10:37 a.m. ET
   We find no statement about the repository from GitHub on X (@github, @GitHubSecurity, @ghsecuritylab) or on the GitHub Blog.

How it happened

AIR Research Lab says the attack goes through the agent, not the developer. Its attack chain: "A developer asks their AI coding agent to build a Solana project. The agent decides to search the web for a starter kit. The agent picks a GitHub repo from the results." The README then tells the agent to run a command. AIR says the repository described itself as an "Open-source Solana dApp template with Anchor program, TypeScript client, and Next.js UI.", but BleepingComputer says "none of that code exists, and the README is the only file in the repository". The README's install step is a PowerShell command that builds the address developer-update.app/update/indicator from fragments, downloads it with iwr and runs it with iex, so nothing is written to disk at that stage. AIR says the recovered payload, indicator.ps1 (about 21 MB, SHA-256 41902d18fa2c285c0f4a6b39cf0f2eefbc7acbff33b6eb6fc88ba680a201d17d), creates a hidden folder named y2inwRnI6G under %LOCALAPPDATA%, writes 13 genuine NetSupport Manager files and one attacker configuration file, client32.ini, that points to maxwintodaybtc.com:443 and turns off the chat, message and disconnect options, adds a Run registry value named SecureModule, starts the client, and then deletes its run history and itself. BleepingComputer says the payload "installs NetSupport Manager, a legitimate remote-access tool, configured to connect to maxwintodaybtc[.]com and give the attacker hidden control of the machine at every login," and that the script then shows a fake error asking the user to "try again in 72 hours," which "an agent could easily relay as a routine server hiccup." AIR links the configuration to a NetSupport cluster that eSentire tracks, and the install command to a campaign that Fortian documented in October 2025, which used fake TradingView "AI signal" videos. AIR says the payload path "returned HTTP 404 when we checked it" and that it recovered the payload from the Web Archive. AIR says "Any coding agent that can search the web and run shell commands" is at risk, and that "this payload only infects Windows machines". Its write-up does not name an agent it tested.

How to check your app

• On Windows, AIR says to look for a hidden folder named y2inwRnI6G under %LOCALAPPDATA%, a SecureModule value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, a client32.exe process running from that folder, or outbound connections to maxwintodaybtc.com:443.
• If you find any of these, AIR says to "disconnect the machine from the network, remove the folder and the Run key, and rotate every credential, token and crypto wallet key that was on it." We suggest moving crypto funds to a new wallet created on a clean machine, not just changing passwords.
• Check your agent's history for a Solana starter kit. We suggest searching agent logs and shell history for solana-starter-kit, SolanaUpdateTools or developer-update, and checking for any PowerShell command that used iwr and iex together.
• Before an agent runs setup commands from a README it found on the web, we suggest requiring your approval for shell commands and reading the command first. A starter kit whose only install step is a one-line download-and-run command is a warning sign.
• For teams, we suggest blocking developer-update.app and maxwintodaybtc.com at the network edge and alerting on NetSupport Manager (client32.exe) where it is not an approved tool.

Sources

• AIR Research Lab (Air Security): SolanaCry: Malware in the wild steals crypto wallets from web-browsing AI agents (Oct 29, 2026). Primary source
• BleepingComputer: Hugging Face malware campaign returns to hijack GPUs for crypto mining (Oct 29, 2026; SolanaCry section, payload confirmed from the Wayback Machine)

Corrections and updates

None. Re-checked against every source on Oct 31, 2026.