Malwarebytes @malwarebytes.com · May 26

We discovered fake installers impersonating popular software including ChatGPT, Claude, AutoTune, and Kontakt on GitHub and SourceForge distributing a Deno backdoor known as DinDoor. Attackers are using compromised YouTube channels to distribute links to the malicious software.

64 likes 4 replies

?

Replies

Dave Conrad · May 26

Free Claude? I didn't even know he was in jail. (Thanks for your research and hard work.)

dnu · May 26

first thing I'd check is persistence, not the brand impersonation. did DinDoor install a launch agent, or was it mostly a one-shot payload from the fake installer?

Sagittarius A* · May 26

well the good news is the sourceforge ones won't be seen by anyone