Security researchers have identified a malicious extension for the Windsurf Integrated Development Environment (IDE) that leverages the Solana blockchain to deploy a multi-stage malware payload. The extension, masquerading as a support tool for the R programming language, was designed to steal sensitive data from Chromium-based browsers.
The attack chain begins with the installation of a fake R language extension, named "reditorsupporter.r-vscode-2.8.8-universal," within the Windsurf IDE. This extension operates within the IDE's trusted ecosystem, making it difficult for traditional endpoint detection solutions to flag. Once installed, the malicious code decrypts an embedded payload, which then initiates system profiling. A key feature of this profiling is the explicit check for indicators of Russian origin, including language settings, time zones, and UTC offsets. If the system is identified as Russian, the malware ceases execution, suggesting a deliberate effort to avoid detection by or scrutiny from Russian authorities.
Instead of relying on conventional command-and-control servers, the malware retrieves its subsequent malicious code fragments from transactions on the Solana blockchain. It queries the blockchain using the `getSignaturesForAddress` method and extracts encoded JavaScript data embedded within transaction metadata. This decentralized approach makes takedown efforts significantly more challenging for security teams.
The retrieved JavaScript payload is base64-encoded and further protected with AES encryption. The loader dynamically reconstructs and executes this code within the NodeJS runtime environment of the Windsurf IDE. Because Windsurf extensions are not strictly sandboxed, the malware gains unrestricted access to the file system and can load native modules.
Following the dynamic execution of the JavaScript, the malware drops compiled native add-ons, identified as .node files and DLLs, into a temporary directory. These components, such as `c_x64.node` and `DllExtractChromiumSecrets.dll`, are designed to interact directly with browser profiles. They are capable of extracting saved credentials, session cookies, and other sensitive data from Chromium-based browsers.
To ensure persistence, the malware utilizes PowerShell to create a hidden scheduled task named "UpdateApp." This task is configured to run at system startup with elevated privileges and bypasses execution policy restrictions. The malware also manipulates specific registry entries to maintain its presence and ensure it relaunches even if the IDE is closed. The final persistence mechanism involves launching a bundled NodeJS executable with a malicious JavaScript file, making the infection self-sustaining across reboots.
This campaign specifically targets developers, who often possess privileged access and valuable credentials such as API keys. The use of a seemingly legitimate development tool extension as an initial vector, combined with the novel use of blockchain infrastructure for payload delivery, highlights an evolving threat landscape where attackers are increasingly embedding malicious activities within trusted software development environments.
