[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpcPEVH4dQdYiZZX8HBjzy-Nts2qb1EV3Gpy86iqXWzY":3},{"article":4,"iocs":55,"watch_terms":72,"solutions":73,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":34,"category":35,"article_tags":39},"946bc793-5457-4f50-9f96-68ee7d5ceacf","Fake GitHub Repo Tricks AI Agents Into Installing SolanaCry Malware","fake-github-repo-tricks-ai-agents-into-installing-solanacry-malware-ecc7b8","A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport.","Security researchers discovered SolanaCry, a malware delivered via a fake GitHub repository impersonating a Solana starter kit that targets AI coding agents. The malicious repo uses PowerShell commands to download and execute a dropper that installs legitimate NetSupport Manager components configured as remote-access malware, giving attackers control over developers' machines and potential access to cryptocurrency wallets. The campaign shows similarities to earlier ClickFix and cryptocurrency-targeting campaigns, highlighting how AI agents can be exploited as attack vectors.","Fake GitHub repo tricks AI agents into installing SolanaCry malware with NetSupport RAT on developers' Windows PCs.","https:\u002F\u002Fhackread.com\u002Ffake-github-repo-ai-coding-agents-solanacry-malware\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Ffake-github-repo-ai-coding-agents-solanacry-malware.jpg","2026-10-30T14:12:28+00:00","2026-10-30T15:00:07.590889+00:00",9,[17,20,22,25,28,31],{"name":18,"type":19},"NetSupport Manager","product",{"name":21,"type":19},"Solana",{"name":23,"type":24},"GitHub","technology",{"name":26,"type":27},"EVALUSION","threat_actor",{"name":29,"type":30},"ClickFix","campaign",{"name":32,"type":33},"AIR Research Lab","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":34,"icon":36,"name":37,"slug":38},null,"Malware","malware",[40,45,50],{"category":41},{"id":42,"icon":36,"name":43,"slug":44},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":46},{"id":47,"icon":36,"name":48,"slug":49},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":51},{"id":52,"icon":36,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66,69],{"type":57,"value":58,"context":59},"domain","maxwintodaybtc.com","C2 server used by NetSupport RAT to connect to infected machines on port 443",{"type":57,"value":61,"context":62},"developer-update.app","Domain registered October 20, 2025 linked to earlier malware campaign targeting cryptocurrency traders",{"type":38,"value":64,"context":65},"SolanaCry","New malware delivered through fake GitHub repository targeting AI agents",{"type":38,"value":67,"context":68},"NetSupport Manager (weaponized)","Legitimate remote-access software repurposed as RAT via malicious configuration file client32.ini",{"type":38,"value":70,"context":71},"indicator.ps1","21 MB PowerShell dropper script downloaded and executed in memory via Invoke-WebRequest\u002FInvoke-Expression",[32,18,21],{"controls":74,"vendors":158},[75,104,133],{"slug":76,"name":77,"problem":78,"products":79},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"slug":105,"name":106,"problem":107,"products":108},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":49,"name":134,"problem":135,"products":136},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[137,145,150],{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":146,"product_name":147,"url":148,"description":149},"boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",[],{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":171},"fake-github-repo-tricks-ai-agents-into-deploying-remote-access-malware","Fake GitHub Repo Tricks AI Agents Into Deploying Remote-Access Malware","Attackers created a convincing fake GitHub repository impersonating a legitimate Solana developer toolkit, tricking AI coding agents into executing malicious PowerShell commands that installed a disguised remote-access tool. This attack exploits a growing blind spot: AI agents can autonomously fetch, trust, and execute code from public repositories without the same skepticism a human developer might apply. The use of legitimate NetSupport Manager components further helped the malware evade detection by blending into expected software behavior. This matters because developers' machines often hold privileged credentials, API keys, and cryptocurrency wallet access, making them high-value targets with cascading impact beyond the initial compromise.",[164,165,166,167,168,169,170],"MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 7: Continuous Vulnerability Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":172,"MITRE ATT&CK T1566: Phishing":173,"NIST SP 800-53 SI-2: Flaw Remediation":174,"CIS Control 7: Continuous Vulnerability Management":175,"CIS Control 14: Security Awareness and Skills Training":176,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":177,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":178},"NIS2 requires supply-chain security measures to manage risks introduced by third-party software and services; the fake repository represents a supply-chain attack that robust third-party vetting procedures under this article would address.","The fake GitHub repository functions as a spear-phishing lure targeting developers and AI agents, delivering a malicious dropper through a trusted-looking social-engineering vector — exactly what this technique describes.","This control requires organizations to control the installation of software, including validating the integrity and provenance of code sources, which would have flagged the unverified fake repository before execution.","Continuous scanning of the development environment, including packages and repositories referenced by AI agents, would have detected the malicious dropper before it was installed and executed.","Developers and AI-agent operators need targeted training to recognize repository impersonation and supply-chain lures; a mature awareness program would have added human scrutiny before an AI agent blindly executed the malicious commands.","This control requires organizations to manage exposure to vulnerabilities introduced through external software and components, directly applicable to vetting open-source repositories before AI agents consume them.","Restricting what AI agents are authorized to fetch and execute — through access control policies on external resources — would have prevented the agent from pulling and running code from an untrusted repository."]