Fake software on GitHub and SourceForge distribute Deno RAT
2026-05-26T20:51:52Z•8abbfe17590cb3f34fa5b6294f1b789fb9f586cc19773a49818a52e8760980ac
CISA KEVChrome updateClickFixDeno RATFirefox updateFox TempestGhost CMSGitHubJDownloader compromiseMicrosoft DefenderPII exposureSourceForgebrowser vulnerabilitiesdata breacheducation sectorfake Cloudflare pagesfake installershealthcare breachmalicious pluginsmalware‑signing fraudsocial engineeringsupply‑chain compromiseweb compromise
What happened
Malwarebytes Labs reported multiple active and high-impact threat trends: fake installers and plugins on GitHub and SourceForge distributing a Deno-based RAT (masquerading as ChatGPT/Claude/AutoTune tools); a large ClickFix campaign abusing a Ghost CMS flaw to hijack 700+ education and tech sites and serve fake Cloudflare verification pages to socially engineer infections; supply-chain and distribution compromises (including JDownloader downloads replaced with malware); a fraudulent malware‑signing service (“Fox Tempest”) used to bypass security protections and recently taken down; exploited/0
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- malwarebytes_labs
- Record identifier
- 8abbfe17590cb3f34fa5b6294f1b789fb9f586cc19773a49818a52e8760980ac
- Enrichment time
- 2026-05-26T20:51:52Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.