ILSpy WordPress Domain Breached to Distribute Malware

• •ILSpy's official WordPress domain was compromised to deliver malware.
• •The attack targets developers relying on ILSpy for .NET code analysis.
• •Users are advised to avoid the compromised site until it is secured.

On April 6, 2026, hackers compromised the official WordPress domain for ILSpy, a widely used open-source tool for .NET code analysis. The breach redirected users from the legitimate site to a malicious webpage designed to deliver malware. This supply chain attack specifically targets software developers who rely on ILSpy for their projects. The incident was confirmed by the Redirection Attack Cybersecurity research group vx-underground, which provided evidence of the breach. Users attempting to download ILSpy software were instead exposed to potential malware infections. The scope of the attack affects all visitors to the compromised site. As of now, the situation is ongoing, and users are advised to avoid the site until further notice.