[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fggkYkw1vm3_D1F1zU36a2dxGnA5_Brm8kMYntTT4-Aw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"5d980927-a858-453b-b25d-2d6eb8dfce57","fake-github-repo-tricks-ai-agents-into-deploying-remote-access-malware","946bc793-5457-4f50-9f96-68ee7d5ceacf","Fake GitHub Repo Tricks AI Agents Into Deploying Remote-Access Malware","Attackers created a convincing fake GitHub repository impersonating a legitimate Solana developer toolkit, tricking AI coding agents into executing malicious PowerShell commands that installed a disguised remote-access tool. This attack exploits a growing blind spot: AI agents can autonomously fetch, trust, and execute code from public repositories without the same skepticism a human developer might apply. The use of legitimate NetSupport Manager components further helped the malware evade detection by blending into expected software behavior. This matters because developers' machines often hold privileged credentials, API keys, and cryptocurrency wallet access, making them high-value targets with cascading impact beyond the initial compromise.","**Immediate actions:**\n- Audit and restrict which external code sources AI coding agents are permitted to fetch from, enforcing an allowlist of verified, trusted repositories.\n- Scan all packages and repositories introduced into development environments with automated malware and reputation checks before execution.\n\n**Long-term improvements:**\n- Establish a formal vetting process for third-party repositories and open-source dependencies, requiring human review before AI agents can integrate new sources.\n- Train developers and AI-agent operators to recognize social-engineering tactics targeting the software supply chain, including typosquatting and impersonation of popular toolkits.\n- Implement least-privilege principles for AI agent runtime environments so they cannot install software or make outbound connections without explicit authorization.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) tooling that alerts on unexpected PowerShell execution, remote-access tool installation, or lateral movement from developer workstations.\n- Monitor outbound network traffic from developer machines for connections to known NetSupport Manager or other RAT command-and-control infrastructure.",[12,13,14,15,16,17,18],"MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 7: Continuous Vulnerability Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 7: Continuous Vulnerability Management":23,"CIS Control 14: Security Awareness and Skills Training":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires supply-chain security measures to manage risks introduced by third-party software and services; the fake repository represents a supply-chain attack that robust third-party vetting procedures under this article would address.","The fake GitHub repository functions as a spear-phishing lure targeting developers and AI agents, delivering a malicious dropper through a trusted-looking social-engineering vector — exactly what this technique describes.","This control requires organizations to control the installation of software, including validating the integrity and provenance of code sources, which would have flagged the unverified fake repository before execution.","Continuous scanning of the development environment, including packages and repositories referenced by AI agents, would have detected the malicious dropper before it was installed and executed.","Developers and AI-agent operators need targeted training to recognize repository impersonation and supply-chain lures; a mature awareness program would have added human scrutiny before an AI agent blindly executed the malicious commands.","This control requires organizations to manage exposure to vulnerabilities introduced through external software and components, directly applicable to vetting open-source repositories before AI agents consume them.","Restricting what AI agents are authorized to fetch and execute — through access control policies on external resources — would have prevented the agent from pulling and running code from an untrusted repository.","published","2026-10-30T15:23:20.212194+00:00","2026-10-30T15:23:20.195+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fhackread.com\u002Ffake-github-repo-ai-coding-agents-solanacry-malware\u002F","fake-github-repo-tricks-ai-agents-into-installing-solanacry-malware-ecc7b8","Fake GitHub Repo Tricks AI Agents Into Installing SolanaCry Malware",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":58,"name":59,"problem":60},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught."]