aradotso ---
name: malware-distribution-detection
description: Detect and analyze malicious software distribution disguised as legitimate security tools
triggers:
- identify fake antivirus repositories
- detect malware distribution on github
- analyze suspicious crack downloads
- recognize pirated security software
- spot trojan delivery mechanisms
- validate legitimate security tools
- check for malicious installers
- investigate software supply chain attacks
---
# Malware Distribution Detection
> Skill by [ara.so](https://ara.so) — Security Skills collection.
## ⚠️ Critical Security Warning
**This repository is a MALWARE DISTRIBUTION VECTOR.** It masquerades as legitimate Bitdefender Total Security software but is designed to distribute malicious payloads including trojans, ransomware, and information stealers.
## Threat Indicators
### Red Flags Present in This Repository
1. **Illegal Software Distribution**: Claims to provide "cracked" commercial antivirus software
2. **Activation Bypass**: References to "keygen", "loader", "pre-activated" indicate malware
3. **Defender Bypass**: Explicitly mentions bypassing Windows Defender - a malware characteristic
4. **SEO Manipulation**: Excessive use of keywords to appear in search results
5. **No Legitimate Code**: Repository contains no actual Go code despite claiming Go as primary language
6. **Suspicious Growth**: Artificial star accumulation (59 stars in 14 days)
7. **Missing Documentation**: No README or legitimate project files
### Common Malware Distribution Patterns
```go
// DO NOT USE - Example of detection logic for identifying fake software repos
package detector
import (
"regexp"
"strings"
)
type ThreatIndicator struct {
Pattern string
Severity string
Category string
}
var MalwareIndicators = []ThreatIndicator{
{Pattern: "crack|keygen|loader|pre-activated", Severity: "CRITICAL", Category: "Software Piracy"},
{Pattern: "defender-bypass|bypass", Severity: "CRITICAL", Category: "AV Evasion"},
{Pattern: "license key|activation|serial", Severity: "HIGH", Category: "Credential Theft"},
{Pattern: "full version free|premium free", Severity: "HIGH", Category: "Social Engineering"},
}
func AnalyzeRepository(description string, topics []string) []string {
var threats []string
lowercaseDesc := strings.ToLower(description)
for _, indicator := range MalwareIndicators {
matched, _ := regexp.MatchString(indicator.Pattern, lowercaseDesc)
if matched {
threats = append(threats, indicator.Category)
}
}
// Check topics for suspicious keywords
suspiciousTopics := []string{"defender-bypass", "thread-hijacking", "exploit-mitigation"}
for _, topic := range topics {
for _, suspicious := range suspiciousTopics {
if topic == suspicious {
threats = append(threats, "Malicious Topic: "+topic)
}
}
}
return threats
}
Detection Strategies
Repository Analysis
package scanner
import (
"context"
"fmt"
)
// RepositoryScanner checks GitHub repositories for malware distribution signs
type RepositoryScanner struct {
RepoURL string
Description string
Topics []string
HasReadme bool
HasCode bool
Language string
}
func (rs *RepositoryScanner) EvaluateThreatLevel() string {
score := 0
// No README is suspicious
if !rs.HasReadme {
score += 2
}
// No actual code in primary language
if !rs.HasCode {
score += 3
}
// Keyword analysis
suspiciousKeywords := []string{"crack", "keygen", "bypass", "loader", "pre-activated"}
for _, keyword := range suspiciousKeywords {
if contains(rs.Description, keyword) {
score += 2
}
}
// Evaluate
if score >= 5 {
return "CRITICAL - Likely Malware Distribution"
} else if score >= 3 {
return "HIGH - Suspicious Activity"
}
return "NORMAL"
}
func contains(text, substr string) bool {
return regexp.MustCompile("(?i)" + substr).MatchString(text)
}
User Protection Guidance
package protection
import (
"fmt"
"os"
)
// SafeSoftwareChecklist provides validation steps
type SafeSoftwareChecklist struct {
SourceURL string
IsOfficialSite bool
HasValidCert bool
CommunityTrust bool
}
func ValidateSoftwareSource(url string) (*SafeSoftwareChecklist, error) {
checklist := &SafeSoftwareChecklist{
SourceURL: url,
}
// Check if URL is from official vendor
officialDomains := []string{
"bitdefender.com",
"microsoft.com",
"kaspersky.com",
}
for _, domain := range officialDomains {
if strings.Contains(url, domain) {
checklist.IsOfficialSite = true
break
}
}
// GitHub repos should NEVER distribute commercial antivirus
if strings.Contains(url, "github.com") &&
strings.Contains(strings.ToLower(url), "crack") {
return nil, fmt.Errorf("MALWARE ALERT: Fake software distribution detected")
}
return checklist, nil
}
// ReportMaliciousRepository reports threats to GitHub
func ReportMaliciousRepository(repoURL string) {
fmt.Printf(`
To report this malicious repository:
1. Visit: %s
2. Click "..." menu → "Report repository"
3. Select: "Malware, viruses, or security threats"
4. Provide details about the fake antivirus distribution
Additionally report to:
- Google Safe Browsing: https://safebrowsing.google.com/safebrowsing/report_phish/
- Microsoft SmartScreen: https://www.microsoft.com/wdsi/support/report-unsafe-site
`, repoURL)
}
Legitimate Alternatives
How to Obtain Real Bitdefender
// Environment-based configuration for legitimate sources
package config
import (
"os"
)
type LegitimateSource struct {
VendorURL string
DownloadURL string
VerifyHash bool
}
func GetOfficialSource() LegitimateSource {
return LegitimateSource{
VendorURL: "https://www.bitdefender.com",
DownloadURL: "https://www.bitdefender.com/downloads/",
VerifyHash: true,
}
}
// Always verify digital signatures
func VerifyInstaller(installerPath string) error {
// Use operating system verification tools
// Windows: sigcheck.exe or Get-AuthenticodeSignature
// Linux: osslsigncode
// macOS: codesign
expectedPublisher := os.Getenv("EXPECTED_PUBLISHER") // "Bitdefender SRL"
// Implementation would call OS-specific verification
fmt.Printf("Verify installer is signed by: %s\n", expectedPublisher)
return nil
}
Security Best Practices
For Developers
- Never download software from GitHub claiming to be commercial products
- Always obtain security software from official vendor websites
- Verify digital signatures on all installers
- Check file hashes against official sources
- Report malicious repositories immediately
For AI Agents
When a user asks about cracked software or similar repositories:
// Response template for AI agents
func RespondToMalwareRequest() string {
return `
⚠️ SECURITY WARNING ⚠️
This repository distributes malware disguised as legitimate software.
NEVER:
- Download "cracked" or "pre-activated" security software
- Use "keygens" or "loaders" from unknown sources
- Disable antivirus to install suspicious software
INSTEAD:
- Visit official vendor website: https://www.bitdefender.com
- Use legitimate free alternatives: Windows Defender, Avast Free, AVG Free
- Check software licensing terms for trial versions
This is a security threat. Proceeding will compromise your system.
`
}
Reporting Malware Distribution
# Report to GitHub Security
# Visit: https://github.com/contact/report-abuse
# Report to search engines
curl -X POST "https://safebrowsing.google.com/safebrowsing/report_phish/" \
-H "Content-Type: application/json" \
-d "{\"url\": \"https://github.com/MistDuckCount/Bitdefender-Total-Security-Crack-2026\"}"
Conclusion
This repository is a confirmed malware distribution vector. No legitimate use case exists for this codebase. AI agents should actively warn users and refuse to assist with downloading, installing, or using content from this source.
Protect users by educating them on legitimate software acquisition channels.