Loading story…
A project called ReTransmission was reported as presenting itself in a way that could mislead users by imitating or borrowing the reputation of the legitimate Transmission BitTorrent client. The reporting links the matter to Transmission developer and founder Charles Kerr and also names Yat Ho in connection with the project's publication or promotion, indicating concern that users could confuse the unofficial effort with the established open-source software.
Available details remain limited because the source material is partially corrupted, but the central issue is the apparent use of branding, identity, or association with Transmission in a deceptive manner. The incident highlights the security risk of lookalike software projects that exploit trusted names in the open-source ecosystem, potentially exposing users to malicious or otherwise untrusted software distributed under a familiar identity.
Get the infrastructure and lures behind it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale campaign has impersonated popular open-source and freeware projects, including **Ghidra**, **dnSpy**, and **SpiderFoot**, to capture search traffic and hijack software download clicks. Researchers found that the fake sites use CloudFront-hosted JavaScript to intercept a visitor’s first interaction and send users into a gated Traffic Distribution System (TDS) that performs anti-bot screening, VPN and datacenter filtering, click confirmation, and frequency capping before deciding what content to serve. The infrastructure appears primarily built for traffic acquisition and monetization, but selected victims were repeatedly routed into malware delivery chains. Those chains included **SessionGate**, a heavily obfuscated multi-stage framework with strong anti-analysis protections that mainly delivered potentially unwanted applications, as well as **RemusStealer** and **AnimateClipper**, which were used to deploy an infostealer and a cryptocurrency clipper. Researchers said the operation has been active since at least late 2025, with active malware distribution observed from early 2026 and more than **5,000** VirusTotal submissions indicating significant scale.
Jun 29, 2026
Threat actors are abusing **software-brand impersonation** to trick users into installing malware from fake distribution points, relying on social engineering rather than software exploits. Datadog reported an active campaign using **fake GitHub repositories** that impersonate established technology companies and leverage the **ClickFix** technique—prompting victims to copy/paste commands into *Terminal* (macOS) or *PowerShell/Run* (Windows)—to install infostealers. Datadog observed iterative updates to the *MacSync* lure and a new macOS infostealer variant self-branded as **“SHub Stealer v2.0”**, with expanded capabilities including **persistence** and **remote access**, alongside anti-analysis/evasion features intended to hinder detection and track infection outcomes; Datadog also assessed signs the actor is expanding toward **Windows infostealer** functionality. Separately, Malwarebytes documented a lookalike **7-Zip** download site (`7zip[.]com`, impersonating the legitimate `7-zip.org`) distributing a **trojanized installer** that installs a working 7-Zip File Manager while silently converting infected Windows systems into **residential proxy nodes**. The installer was **Authenticode-signed** with a certificate issued to **Jozeal Network Technology Co., Limited** (now revoked), and it dropped additional components—`Uphero.exe` (service manager/update loader), `hero.exe` (Go-compiled proxy payload), and `hero.dll`—under `C:\Windows\SysWOW64\hero\`; one reported case surfaced via Microsoft Defender detection `Trojan:Win32/Malgent!MSR` after the system had been exposed for an extended period. Together, the reporting highlights a sustained risk from **trusted-brand impersonation** and “looks legitimate” installers/repositories that deliver credential theft or monetize endpoints via proxyware.
Jul 2, 2026
A **malicious fork** of the legitimate *Triton* macOS application surfaced on GitHub under the account **“JaoAureliano,”** abusing developer trust in open-source repositories to distribute malware. The repository copied the original project but repeatedly embedded deceptive download links in the README that redirected users to a trojanized ZIP (`Software_3.1.zip`) hidden inside an Xcode colorset directory, despite *Triton* being macOS-only; the delivered payload targeted **Windows** systems. The activity was flagged by a security researcher (Brennan) after discussion of suspicious forking behavior, and analysis noted multiple red flags including sparse real development activity and an apparently manipulated contribution graph using automated/backdated commits. The malware sample was reported as **1.33 MB** and showed partial detection on VirusTotal (e.g., **12/66** engines) with a published SHA-256 `39b29c38c03868854fb972e7b18f22c2c76520cfb6edf46ba5a5618f74943eac`. Reported execution details included a multi-stage chain beginning with archive extraction via `7za.exe` using the password `infected`, and use of **LuaJIT** as part of the payload’s scripting/execution flow. At the time of discovery, the malicious GitHub account reportedly remained online despite reports, reinforcing an ongoing pattern of GitHub being leveraged as a malware distribution channel.
Jun 29, 2026