Brief · Builders

Your Agent Took the Top Search Result. So Did the Malware.

By alkizz · Oct 30, 2026

On Oct 29, AIR Research Lab published "SolanaCry", Eliad Mualem and Dor Granat's write-up of malware in the wild that goes through AI coding agents instead of the people using them. The setup is simple: a GitHub repo posing as a Solana starter kit, SolanaUpdateTools/solana-starter-kit, which AIR said "ranks as the top result when an agent searches for one". Its README's only install step was a PowerShell one-liner that downloaded a script and ran it in memory, and that script installs a NetSupport remote-access tool (RAT) pointed at the attackers' server. AIR's headline says it steals crypto wallets. What the write-up actually describes is full remote control of the machine, "including the crypto wallets on it", which is arguably worse, because a wallet is just one of the things on that machine.

AIR's own framing is that "the malware and techniques aren't necessarily new, but the path to the victim is." I agree, and that's the useful part. The attackers didn't have to talk a developer into pasting anything. They only had to get an agent to pick their repo and follow its README, and as AIR puts it, the developer "may never inspect the repository or the commands being executed."

What AIR found

The repo looked fine at a glance. AIR lists it as created in November 2025, with 286 stars and the self-description "Open-source Solana dApp template with Anchor program, TypeScript client, and Next.js UI."
The install step is the attack. The README's one-liner glued the pieces of a URL together from variables ($update, $mode, $key, $file) to spell out developer-update[.]app/update/indicator, then fetched it with iwr and ran it with iex. In AIR's words, "Nothing touches disk at this delivery stage."
The payload is mostly legitimate software. The recovered indicator.ps1 is about 21 MB and drops 14 files into a hidden folder called y2inwRnI6G under %LOCALAPPDATA%. Thirteen are genuine, signed NetSupport Manager components (v12.10, per AIR), and the one file the attackers wrote is client32.ini, which points the client at maxwintodaybtc[.]com:443, hides the user-facing UI including the disconnect button, and "Accepts any operator from any IP address."
It sticks around and cleans up after itself. It adds a SecureModule value to the current user's Run key so client32.exe starts at every login, then clears the RunMRU history and deletes its own script.
NetSupport gives the attackers the whole box. AIR lists screen viewing and control, keyboard and mouse, file transfer, remote commands, audio capture and registry access, and in my view nobody needs a wallet-specific stealer when they can just browse your files and watch your screen.
The operator has done this before. The RADIUSSecret in the config matches the value eSentire uses to identify EVALUSION, one of what eSentire says may be three distinct NetSupport threat groups and, per AIR, the most active. Fortian documented the same one-liner shape, down to the variable names, in an Oct 2025 campaign that lured traders with fake TradingView "AI indicator" videos pointing to a GitHub repo. AIR's summary: "first traders, then developers, and now the AI agents working for them."

What AIR doesn't say

A few things are worth keeping straight before anyone calls this the end of vibe coding:

It's Windows-only as written. The command is PowerShell, and AIR says "this payload only infects Windows machines," though it adds that the technique works the same way on any operating system.
The payload is offline. AIR says the payload URL returned a 404 when it checked, so it recovered the script from the Web Archive, where, by AIR's timeline, it was archived on Nov 22, 2025. The repo itself returned a 404 when we checked on Oct 30, though AIR's post doesn't say whether it was taken down. AIR expects "new repos and domains rather than this one coming back."
There's no victim count. The write-up doesn't report any confirmed infections, and it doesn't say which agent, search tool or query put the repo at the top, or when it checked.
AIR sells a fix. The post ends with a pitch for Air Filter, its product for filtering malicious content before agents read it. That doesn't make the research wrong, but it's worth knowing.

Why the agent is the easier mark

My opinion: it's easier to fool your agent than to fool you. A person who sees a README asking them to pipe a remote script into PowerShell might at least squint at the domain. An agent that's been told to "set up a Solana project" sees an install step that serves the task it was given, and if it's allowed to run shell commands without asking, it just does it. Per AIR, the top ranking, 286 stars and tidy description made the repo "a likely choice" for an agent, and the attackers never had to compromise a real project. We covered the other half of this in the approval prompt brief: the prompt only helps if it's on and someone reads it.

The other thing I'd note is that the obvious "check the repo's age" advice wouldn't have saved you here, because by AIR's dates the repo had been up for almost a year when the write-up came out. Age is one signal, not a verdict.

The score

I'd call it a 3, patch normally. This is real malware in the wild that's aimed squarely at coding agents, but this particular payload is offline, it only works on Windows, there's no reported victim count, and it needs an agent that can run shell commands without anyone approving them. If your agent runs unattended on a Windows machine that holds wallets or keys, your own risk is higher than the score.

My take: Humans are increasingly trusting their AI agents to help them accomplish stuff. These agents' instructions are to get stuff done for their humans. This dynamic leads to humans doing things via agents that they'd never have done before, like getting yoinked by weird repos.

What to do:

Make your agent ask before it runs shell commands.
- Why: the whole attack is one shell command in a README, and per AIR the developer may never see it. An approval prompt is the one place you'd see it before it runs.
- How: turn off any auto-approve, "yolo" or skip-permissions mode on the machine you work on. In Claude Code, Manual mode (config value default) asks before Bash commands except a built-in set of read-only ones, and choosing "Yes, and don't ask again" saves that approval permanently for the repository and command, so don't pick it for install steps. Recent versions start terminal and VS Code sessions in auto mode, which swaps your review for a classifier, so check which mode you're in. You can lock both auto and bypass mode off by setting permissions.disableBypassPermissionsMode and permissions.disableAutoMode to "disable" in your settings, or in managed settings for a team, and sessions then start in Manual. Whatever agent you use, say no to anything that downloads and runs remote code in one go, like iwr ... | iex or curl ... | sh, which is exactly what AIR advises. More in Builders checklist #5 and #16.
Keep wallets, keys and seed phrases off the agent's machine.
- Why: NetSupport gives the attackers file transfer, remote commands and your screen, so anything on that machine is theirs. Solana's own CLI docs say a file system wallet is "an unencrypted keypair file" and "Anyone with access to this file will have access to all tokens sent to its public key."
- How: run the agent in a container, a VM or a separate user account that has no wallet extensions, keypair files, seed phrases, SSH keys or cloud credentials, and mount only the project folder it needs. For Solana work, give it a throwaway keypair with no real funds and keep your real wallet on another machine or a hardware wallet. See Builders checklist #4.
Check the repos the agent picks before it uses them.
- Why: per AIR, being the top search result with 286 stars and a convincing description made this repo "a likely choice for an agent searching for a starter kit."
- How: have the agent show you the repo it plans to use before it clones anything, then look at who owns it (is it the project's official org, or something like "SolanaUpdateTools"?), whether the commit history and contributors match the star count, and whether the README's install step pipes a download from an unfamiliar domain into a shell. Prefer the templates linked from the project's own documentation over whatever search turns up. Telling the agent this in its instructions helps, but it's a request, not a lock, so keep the approval prompt on as well. See Builders checklist #10.
Check whether a Windows machine was hit.
- Why: AIR published specific indicators, and the dropper deletes its script and run history, so you have to look for what it leaves behind.
- How: look for a hidden y2inwRnI6G folder under %LOCALAPPDATA%, a SecureModule value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, a client32.exe running from that folder, or outbound connections to maxwintodaybtc[.]com:443. If you find any of them, AIR says to disconnect the machine from the network, remove the folder and the Run key, and rotate every credential, token and crypto wallet key that was on it. My suggestions, not AIR's: before you delete anything, copy the client32.ini from that folder and note the time you found it, so you have a record of what it connected to and when. Then move any funds to a fresh wallet created on a clean machine, since the old keys should be treated as known to the attackers.
Businesses: block remote-access tools you didn't approve.
- Why: the payload is legitimate, signed NetSupport software. In Fortian's TradingView case, Defender for Endpoint flagged parts of the chain but didn't block it, which Fortian thinks was partly down to "the abuse of signed/legitimate binaries", so don't count on antivirus alone.
- How: eSentire recommends you "Prevent the installation and usage of non-approved RMM tooling." Fortian's detection list includes RMM tools written to disk by command interpreters, PowerShell download-and-run-in-memory, and attempts to clear the RunMRU registry key, and it recommends filtering connections to newly registered domains. Apply those to developer machines that run coding agents, not just the rest of the fleet.

Sources

← All briefs

Your Agent Took the Top Search Result. So Did the Malware.

What AIR found

What AIR doesn't say

Why the agent is the easier mark

The score

Want the next one?

Sources

Related

On the checklist

More briefs