Hackers Impersonate Ghidra, dnSpy, and SpiderFoot to Spread Malware via Fake Download Sites

Cybersecuritynews •Tushar Subhra Dutta • June 4, 2026

Hackers are creating convincing fake websites that impersonate popular security tools to trick users into downloading malware. Instead of obvious phishing pages, these sites look almost identical to real project portals, complete with professional designs and links pointing to actual GitHub repositories. The moment a user clicks the download button, something very different happens behind […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fake Security Tool Sites Spread Malware to Users Hackers are impersonating well-known security tools like Ghidra, dnSpy, and SpiderFoot to distribute malware through convincing fake download sites. These sites mimic legitimate project portals, complete with professional designs and links to actual GitHub repositories. Users are tricked into clicking download buttons, which redirect them to a traffic distribution system (TDS) that delivers various malware types, including infostealers and loaders. The attack primarily targets individuals seeking security tools, potentially affecting thousands of users. The scope of the impact is significant due to the popularity of the impersonated tools. As of now, there is no specific information on the number of victims or the exact malware variants being distributed. Security professionals are advised to be cautious when downloading software from unofficial sources. 2 sources 65

Extracted Entities

Hackers Impersonate Ghidra, dnSpy, and SpiderFoot to Spread Malware via Fake Download Sites

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (1)

Tools (3)