Bitdefender Finds Malicious Russian Malware In Solana Cryptocurrency Blockchain

Bitdefender researchers have uncovered a malicious extension targeting the Windsurf integrated development environment (IDE) that uses the Solana blockchain to deliver credential-stealing malware to developers.

The campaign disguises the extension as a tool for R language development inside Visual Studio Code-compatible environments. Once installed, it deploys a multi-stage NodeJS information stealer capable of extracting browser passwords, session cookies and other sensitive data from Chromium-based browsers.

How The Attack Was Discovered

Bitdefender’s Endpoint Detection and Response (EDR) platform flagged suspicious activity linked to windsurf.exe on a corporate workstation. Investigation revealed the user had installed what appeared to be a legitimate R development extension named reditorsupporter.r-vscode-2.8.8-universal, which closely resembles the legitimate REditorSupport extension.

The discovery highlights a growing trend of attackers targeting developer environments, where API keys, privileged credentials and access to production systems are often stored or cached.

Blockchain-Based Payload Delivery

What sets this campaign apart from conventional malware distribution is its use of the Solana blockchain as a delivery mechanism for malicious payloads.

Once installed, the extension conceals its true functionality through encrypted JavaScript code that only decrypts after installation. The decrypted loader then retrieves additional malicious payloads embedded within Solana blockchain transactions, allowing attackers to bypass traditional command-and-control infrastructure.

By storing payloads on the blockchain rather than on conventional servers, the attackers make takedown efforts considerably more difficult. Blockchain transactions are immutable and decentralised, meaning there is no single server for security teams or law enforcement to shut down.

Environment Checks And Russia Exclusion

The malware performs a series of environment checks before executing its payload. These include gathering system information, examining locale and timezone data, and determining whether the infected system is located in Russia.

If Russian indicators are detected, the malware terminates its execution – a behaviour commonly associated with threat actors operating from within Russia or neighbouring countries who seek to avoid drawing attention from local law enforcement.

Persistence Through Scheduled Tasks

The malware maintains persistence on infected systems through a hidden Windows scheduled task that relaunches the malicious code via a bundled NodeJS runtime. This means the malware can survive system reboots and continue operating even if the original IDE extension is removed.

Why Developers Are High-Value Targets

Developers often have privileged access to systems, credentials and API keys that extend well beyond their own workstations. Compromising a developer’s machine can give attackers a pathway into production environments, intellectual property and sensitive credentials that could enable broader supply-chain compromises.

The targeting of IDE extensions is a relatively recent tactic but one that exploits the high level of trust developers place in their toolchains. Extensions are often installed with minimal scrutiny, particularly in environments where developers have administrative control over their own workstations.

Recommendations For Security Teams

Bitdefender advised developers and organisations to carefully verify extensions before installation, limit permissions granted to development tools and monitor developer environments for unusual activity.

Security teams should also enforce strict extension governance policies and deploy endpoint detection solutions capable of identifying malicious behaviour inside trusted software ecosystems.

As development platforms and blockchain infrastructure become more widely adopted, researchers expect threat actors to increasingly experiment with unconventional delivery mechanisms designed to bypass traditional security controls. The use of decentralised infrastructure for command-and-control purposes is likely to become a more common feature of advanced campaigns targeting software supply chains.

Last Updated on March 19, 2026 by Nick Ross