Fake ChatGPT installers on GitHub are dropping Deno RATs
Fake software impersonating popular applications is being distributed on GitHub and SourceForge, delivering a Deno backdoor known as DinDoor. Attackers are leveraging compromised YouTube channels to promote these malicious links, targeting users interested in unofficial tools. Users are advised to download software only from official sources and remain cautious of unofficial versions.
- ▪Malicious installers for software like ChatGPT and AutoTune are found on GitHub and SourceForge.
- ▪Attackers use compromised YouTube channels to redirect users to these malicious repositories.
- ▪The Deno RAT can exfiltrate data and execute additional payloads on infected machines.
Hacker News (Newest) files mainly under programming. We currently carry 5,306 of its stories.
Story provenance
Source · retrieval · rights · ranking — open for full record
inspect →
Story provenance
Attribution is not the same as permission. This drawer separates discovery metadata, excerpts, WeSearch-generated summaries, reuse status, and whether the publisher receives the visit. Nothing here claims a legal grant the publisher has not made.
Record
| Original publisher | Vechron |
| Canonical URL | https://vechron.com/2026/05/fake-software-on-github-and-sourceforge-distribute-deno-rat/ |
| Publication time | Tue, 26 May 2026 16:57:45 +0000 |
| Retrieval time | 2026-05-26T17:07:50.079Z |
| Last seen | 2026-05-26T17:07:50.079Z |
| Headline source | Publisher (no WeSearch rewrite) |
| Excerpt source | publisher body |
| Excerpt method | First ~120 words (~800 chars) of extracted publisher body, fair-use limited. |
| Summary | WeSearch · cerebras-chat (WeSearch summarizer) |
| Summary source text | contentText |
| Citation coverage | Summary is a WeSearch-generated derivative; primary citation is the original publisher URL. |
| Cluster | tCcixqKTssdK |
| Cluster logic | Grouped by semantic title/content similarity across sources within a rolling window. Same-publisher template collisions are excluded from coverage comparison. |
| Ranking reason | Story pages are not engagement-ranked. Hub feeds use recency, with optional source-diversified chronological ordering (cap consecutive stories per source). No personalized ranking. |
| Publisher visit | Yes — open original |
| Substitutes article? | No — link-out required for full text |
Rights status (four layers)
WeSearch handling by dimension
| Indexing | May the item be indexed (stored, ranked, made findable)? | Allowed |
| Snippet | May a short excerpt of the publisher's text be shown? | Allowed |
| AI summary | May WeSearch generate its own short summary of the article? | Limited |
| Retrieval / RAG | May the content be exposed for third-party retrieval-augmented generation? | Not asserted |
| Model training | May the content be used to train AI models? | Not asserted |
| Commercial reuse | May the content be reused commercially? | Not permitted |
Basis: Derived from the published RSS/Atom feed. Contact: [email protected]. Reviewed: 2026-07-24.
Opening excerpt (first ~120 words) tap to expand
Vechron > Cybercrime > Fake software on GitHub and SourceForge distribute Deno RAT Cybercrime Fake software on GitHub and SourceForge distribute Deno RAT Last updated: 2026/05/26 at 10:20 PM Nikhil Das Share 15 Min Read Compromised YouTube channels with AI-generated videos SHARE The post Fake software on GitHub and SourceForge distribute Deno RAT⤴︎ appeared first on Malwarebytes⤴︎. During our threat hunting activities, we found fake installers and plugins impersonating popular software including ChatGPT, Claude, AutoTune, and Kontakt on GitHub and SourceForge distributing a Deno backdoor known as DinDoor. Attackers are using compromised YouTube channels to distribute links to these platforms.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at Vechron.
Discussion
0 commentsMore from Vechron
