Malicious Windsurf IDE Extension Uses Solana Blockchain to Steal Developer Data

Security researchers uncovered a targeted campaign distributing a malicious Windsurf IDE extension ('Windsurf Stealer') that uses the Solana blockchain for command-and-control. The malware remains dormant to evade detection, performs geographic checks to exclude certain regions, establishes persistence via a hidden PowerShell scheduled task and registry manipulation, and launches a Node.js-based stealer that leverages native.node DLLs to harvest Chromium browser passwords, cookies, and developer secrets — posing a high-risk supply-chain threat to developer workstations.