Fake Ghidra, dnSpy & SpiderFoot Sites Used to Spread Malware

Gbhackers •Mayura Kathir • June 4, 2026

Hackers are abusing results and professional-looking fake download portals to distribute malware by impersonating popular security tools like Ghidra, dnSpy, and SpiderFoot. These sites capture users’ first click on a “Download” button and silently hand it to a traffic distribution system (TDS) that can route victims to infostealers, clippers, and a sophisticated loader framework […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fake Security Tool Sites Spread Malware to Users Hackers are impersonating well-known security tools like Ghidra, dnSpy, and SpiderFoot to distribute malware through convincing fake download sites. These sites mimic legitimate project portals, complete with professional designs and links to actual GitHub repositories. Users are tricked into clicking download buttons, which redirect them to a traffic distribution system (TDS) that delivers various malware types, including infostealers and loaders. The attack primarily targets individuals seeking security tools, potentially affecting thousands of users. The scope of the impact is significant due to the popularity of the impersonated tools. As of now, there is no specific information on the number of victims or the exact malware variants being distributed. Security professionals are advised to be cautious when downloading software from unofficial sources. 2 sources 65

Fake Ghidra, dnSpy & SpiderFoot Sites Used to Spread Malware

The full story

Extracted Entities

Attack Types (1)

Tools (4)