Windsurf IDE Extension Drops Malware via Solana Blockchain

MITRE Techniques

• [T1204.002] Malicious File – The victim installed a fake Windsurf extension that launched the infection inside the IDE ecosystem (‘a fake R language development extension installed inside Windsurf IDE triggers a malware infection’).
• [T1027] Obfuscated Files or Information – The loader used encrypted and base64-encoded JavaScript to conceal the real payload (‘decrypting an embedded payload’, ‘Base64 JavaScript layered with AES-encrypted payload components’).
• [T1497.001] Virtualization/Sandbox Evasion: System Checks – The payload profiled the host and quit on Russian indicators to avoid execution on targeted systems (‘it looked for language markers’, ‘compared the system timezone’, ‘execution stopped immediately’).
• [T1105] Ingress Tool Transfer – The malware retrieved JavaScript payload fragments remotely from Solana transaction data (‘it queried blockchain transactions and retrieved encoded data embedded within transaction metadata’).
• [T1059.007] Command and Scripting Interpreter: JavaScript – The malicious logic ran as JavaScript within the NodeJS runtime (‘executed it using NodeJS runtime primitives’, ‘a second-stage JavaScript component’).
• [T1106] Native API – The PowerShell loader used Win32 API calls via Add-Type and NodeJS loaded native .node modules for browser data theft (‘leveraged Win32 API calls through Add-Type’, ‘loaded by NodeJS as .node files’).
• [T1053.005] Scheduled Task/Job: Scheduled Task – Persistence was created through a hidden scheduled task named UpdateApp that ran at startup (‘created a scheduled task named: UpdateApp’, ‘run at startup with the highest privileges’).
• [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – The script interacted with HKCU Run persistence and removed evidence of it (‘interacted with the following registry entry’, ‘HKCU:SoftwareMicrosoftWindowsCurrentVersionRun’).
• [T1059.001] Command and Scripting Interpreter: PowerShell – PowerShell was used to hide the console, create persistence, and launch node.exe (‘invoked PowerShell to achieve persistence’, ‘hid its console window’).