Fake GitHub Repo Delivers SolanaCry Malware via AI Agents

• •SolanaCry malware targets AI coding agents via a fake GitHub repository.
• •The attack exploits trust in AI agents, allowing malware installation without user intervention.
• •Malware includes legitimate NetSupport components, enabling remote access to infected systems.

AIR Research Lab has identified SolanaCry, a malware targeting AI coding agents through a fraudulent GitHub repository masquerading as a Solana starter kit. This repository, created in November 2025, ranked first in search results and instructed AI agents to execute a PowerShell command that installs remote-access malware on Windows machines. The malware, which includes legitimate components of NetSupport Manager, allows attackers to control infected systems and access cryptocurrency wallets. The attack exploits the trust developers place in AI agents, making it a novel threat vector. Researchers noted similarities to previous campaigns, particularly one from October 2025 that also targeted cryptocurrency traders. The repository had 286 stars at the time of discovery, indicating significant visibility. The attack method involves fileless execution, hiding its presence from users. Current status indicates ongoing risks as the malware remains undetected by many users.