Researchers at Air Security recently uncovered a campaign where threat actors leveraged a fraudulent GitHub project masquerading as a foundational toolkit for Solana development. When an autonomous coding assistant follows the setup instructions hosted within this repository, it unknowingly triggers a single-line PowerShell command. Utilizing fileless execution techniques, the command executes a malicious script directly in the system's memory. Meanwhile, the payload covertly deploys a modified version of NetSupport Manager remote access tool. By pairing the software with a customized configuration file and disabling all visible alerts, the perpetrators establish a stealthy connection to an external command server. This grants the attackers persistent, unrestricted access to the compromised computer and its cryptocurrency wallets—allowing them to monitor screens, transfer files, capture audio, and execute arbitrary commands.
Symantec protects you from this threat, identified by the following:
Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.
Machine Learning-based
Observed domains/IPs are covered under security categories in all WebPulse enabled products
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
