Fake ChatGPT installers on GitHub are dropping Deno RATs
Fake software impersonating popular applications is being distributed on GitHub and SourceForge, delivering a Deno backdoor known as DinDoor. Attackers are leveraging compromised YouTube channels to promote these malicious links, targeting users interested in unofficial tools. Users are advised to download software only from official sources and remain cautious of unofficial versions.
- ▪Malicious installers for software like ChatGPT and AutoTune are found on GitHub and SourceForge.
- ▪Attackers use compromised YouTube channels to redirect users to these malicious repositories.
- ▪The Deno RAT can exfiltrate data and execute additional payloads on infected machines.
Opening excerpt (first ~120 words) tap to expand
Vechron > Cybercrime > Fake software on GitHub and SourceForge distribute Deno RAT Cybercrime Fake software on GitHub and SourceForge distribute Deno RAT Last updated: 2026/05/26 at 10:20 PM Nikhil Das Share 15 Min Read Compromised YouTube channels with AI-generated videos SHARE The post Fake software on GitHub and SourceForge distribute Deno RAT⤴︎ appeared first on Malwarebytes⤴︎. During our threat hunting activities, we found fake installers and plugins impersonating popular software including ChatGPT, Claude, AutoTune, and Kontakt on GitHub and SourceForge distributing a Deno backdoor known as DinDoor. Attackers are using compromised YouTube channels to distribute links to these platforms.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at Vechron.
Discussion
0 commentsMore from Vechron
