SolanaCry: agents searching the internet attacked by malware discovered in the wild, steals their crypto wallets

The report

AIR Research Lab discovered malware in the wild that targets AI agents creating crypto wallets. A GitHub repository posing as a Solana starter kit, which ranks as the top result when an agent searches for one, contains malware that gives an attacker remote control of the victim’s machine, including the crypto wallets on it.

Read the full analysis: SolanaCry: agents searching the internet attacked by malware discovered in the wild, steals their crypto wallets (air.security).

Indicators

Malware C

• maxwintodaybtc[.]com

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#31). This page is generated from that record and the report’s own title and summary; nothing is rewritten.