# SolanaCry: a poisoned starter kit turns coding agents into RAT installers

> SolanaCry reaches developers through their coding agents: a poisoned Solana starter kit whose only install step drops a remote access trojan.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Supply chain, Attack
- **Published by:** AIR Security
- **Disclosed:** 2026-10-29
- **Affects:** AI coding agents, Windows, Crypto wallets
- **Research by:** Eliad Mualem (AIR Research Lab), Dor Granat (AIR Research Lab)
- **Primary source:** https://air.security/blog-posts/solanacry
- **Page:** https://theinjection.dev/items/air-solanacry-agent-starter-kit-rat/

SolanaCry is malware AIR Research Lab found in the wild that reaches developers through their coding agents: the agent searches for a Solana starter kit, picks a poisoned GitHub repo, and runs the README's one-line PowerShell install.

## What happened

AIR Research Lab published SolanaCry on October 29, 2026, describing malware it says it discovered in the wild targeting AI agents that build crypto wallet projects. Eliad Mualem and Dor Granat traced the lure to a GitHub repository, SolanaUpdateTools/solana-starter-kit, which AIR reports appeared as the top search result with 286 stars and a convincing description. AIR links the operator to the EVALUSION cluster that eSentire tracks, based on a shared RADIUS secret value.

## How it works

A coding agent asked to build a Solana project searches the web, picks the repository from the results, and reads a README whose only installation step is a one-line PowerShell command. That command downloads a payload and runs it in memory, so nothing is written to disk at that stage. The payload decodes 14 embedded files, 13 of them genuine NetSupport Manager v12.10 components plus one attacker-supplied configuration, into a hidden folder, adds a Run registry entry, and starts the client after a 10 second delay. The configuration points at a command server on port 443, accepts connections from any operator address, and disables the user-facing chat and disconnect controls.

## Who is affected

Any coding agent that can search the web and run shell commands can pick up the lure, AIR says, and the recovered payload runs on Windows. Developers who let an agent install dependencies without review are the exposed group, and the machines the operator wants are the ones holding crypto wallet keys.

## What to do

Treat everything an agent reads, including search results, READMEs and docs, as untrusted input, and do not let an agent run download-and-execute commands such as iwr | iex or curl | sh without review. Check for the indicators listed below. If any are present, disconnect the machine, remove the folder and the Run key, and rotate every credential, token and wallet key that was on it.

## Quick facts

- **Affected:** Any coding agent that can search the web and run shell commands
- **Found by:** Eliad Mualem and Dor Granat, AIR Research Lab
- **Disclosed:** October 29, 2026
- **Payload:** NetSupport Manager v12.10 components repackaged as a remote access trojan
- **Lure repo:** SolanaUpdateTools/solana-starter-kit, 286 stars, created November 2025
- **Indicators:** Folder y2inwRnI6G under %LOCALAPPDATA%, SecureModule value under HKCU Run, client32.exe in that folder, traffic to maxwintodaybtc.com:443
- **Status:** No fix: the lure is a malicious repository, not a product flaw

## Questions

### Is my coding agent affected by SolanaCry?

SolanaCry can reach any coding agent that searches the web and runs shell commands, according to AIR Research Lab. Exposure depends on configuration rather than on which agent you run: agents allowed to install dependencies without human review are the ones that will execute the README's PowerShell one-liner. The payload AIR recovered runs on Windows.

### How do I check whether SolanaCry infected a developer machine?

AIR lists four indicators for SolanaCry: a hidden folder named y2inwRnI6G under %LOCALAPPDATA%, a SecureModule value under the HKCU Run key, a client32.exe process running from that folder, and outbound connections to maxwintodaybtc.com on port 443. AIR also publishes the recovered payload's SHA-256. Any of these means the NetSupport-based trojan is installed and credentials need rotating.

### Is there a patch for SolanaCry?

No patch exists for SolanaCry, because the attack is a malicious GitHub repository and a download-and-execute install step, not a flaw in an agent product. AIR advises blocking agents from running commands such as iwr | iex or curl | sh unreviewed, and expects the operator to keep rotating lures, so new repositories and domains will follow the ones named in the report.

### How does SolanaCry differ from AIR's earlier Web Hole research?

Web Hole, which AIR published on October 23, 2026, showed that expired domains still rank in the search results agents read. SolanaCry is the live-malware case: a repository that AIR says ranked first for Solana starter kit searches and delivered a NetSupport-based remote access trojan. Both findings share one root cause, an agent trusting whatever a web search returns.

## Sources

1. [AIR Research Lab Post](https://air.security/blog-posts/solanacry)
2. [eSentire on EVALUSION](https://www.esentire.com/blog/unpacking-netsupport-rat-loaders-delivered-via-clickfix)
3. [Fortian TradingView Lure](https://www.fortian.com.au/blog/the-indicator-you-didnt-backtest-fake-tradingview-videos-driving-infostealers.html)