# Malware Distribution Detection

> ```markdown

- Skill: `aradotso-security-skills/malware-distribution-detection` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aradotso-security-skills/malware-distribution-detection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aradotso-security-skills/malware-distribution-detection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Docs & Writing
- Author: aradotso (https://skillmd.com/u/aradotso-security-skills)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/aradotso-security-skills/malware-distribution-detection

---

```markdown
---
name: malware-distribution-detection
description: Detect and analyze malicious software distribution disguised as legitimate security tools
triggers:
  - identify fake antivirus repositories
  - detect malware distribution on github
  - analyze suspicious crack downloads
  - recognize pirated security software
  - spot trojan delivery mechanisms
  - validate legitimate security tools
  - check for malicious installers
  - investigate software supply chain attacks
---

# Malware Distribution Detection

> Skill by [ara.so](https://ara.so) — Security Skills collection.

## ⚠️ Critical Security Warning

**This repository is a MALWARE DISTRIBUTION VECTOR.** It masquerades as legitimate Bitdefender Total Security software but is designed to distribute malicious payloads including trojans, ransomware, and information stealers.

## Threat Indicators

### Red Flags Present in This Repository

1. **Illegal Software Distribution**: Claims to provide "cracked" commercial antivirus software
2. **Activation Bypass**: References to "keygen", "loader", "pre-activated" indicate malware
3. **Defender Bypass**: Explicitly mentions bypassing Windows Defender - a malware characteristic
4. **SEO Manipulation**: Excessive use of keywords to appear in search results
5. **No Legitimate Code**: Repository contains no actual Go code despite claiming Go as primary language
6. **Suspicious Growth**: Artificial star accumulation (59 stars in 14 days)
7. **Missing Documentation**: No README or legitimate project files

### Common Malware Distribution Patterns

```go
// DO NOT USE - Example of detection logic for identifying fake software repos

package detector

import (
    "regexp"
    "strings"
)

type ThreatIndicator struct {
    Pattern  string
    Severity string
    Category string
}

var MalwareIndicators = []ThreatIndicator{
    {Pattern: "crack|keygen|loader|pre-activated", Severity: "CRITICAL", Category: "Software Piracy"},
    {Pattern: "defender-bypass|bypass", Severity: "CRITICAL", Category: "AV Evasion"},
    {Pattern: "license key|activation|serial", Severity: "HIGH", Category: "Credential Theft"},
    {Pattern: "full version free|premium free", Severity: "HIGH", Category: "Social Engineering"},
}

func AnalyzeRepository(description string, topics []string) []string {
    var threats []string
    lowercaseDesc := strings.ToLower(description)
    
    for _, indicator := range MalwareIndicators {
        matched, _ := regexp.MatchString(indicator.Pattern, lowercaseDesc)
        if matched {
            threats = append(threats, indicator.Category)
        }
    }
    
    // Check topics for suspicious keywords
    suspiciousTopics := []string{"defender-bypass", "thread-hijacking", "exploit-mitigation"}
    for _, topic := range topics {
        for _, suspicious := range suspiciousTopics {
            if topic == suspicious {
                threats = append(threats, "Malicious Topic: "+topic)
            }
        }
    }
    
    return threats
}
```

## Detection Strategies

### Repository Analysis

```go
package scanner

import (
    "context"
    "fmt"
)

// RepositoryScanner checks GitHub repositories for malware distribution signs
type RepositoryScanner struct {
    RepoURL     string
    Description string
    Topics      []string
    HasReadme   bool
    HasCode     bool
    Language    string
}

func (rs *RepositoryScanner) EvaluateThreatLevel() string {
    score := 0
    
    // No README is suspicious
    if !rs.HasReadme {
        score += 2
    }
    
    // No actual code in primary language
    if !rs.HasCode {
        score += 3
    }
    
    // Keyword analysis
    suspiciousKeywords := []string{"crack", "keygen", "bypass", "loader", "pre-activated"}
    for _, keyword := range suspiciousKeywords {
        if contains(rs.Description, keyword) {
            score += 2
        }
    }
    
    // Evaluate
    if score >= 5 {
        return "CRITICAL - Likely Malware Distribution"
    } else if score >= 3 {
        return "HIGH - Suspicious Activity"
    }
    
    return "NORMAL"
}

func contains(text, substr string) bool {
    return regexp.MustCompile("(?i)" + substr).MatchString(text)
}
```

### User Protection Guidance

```go
package protection

import (
    "fmt"
    "os"
)

// SafeSoftwareChecklist provides validation steps
type SafeSoftwareChecklist struct {
    SourceURL       string
    IsOfficialSite  bool
    HasValidCert    bool
    CommunityTrust  bool
}

func ValidateSoftwareSource(url string) (*SafeSoftwareChecklist, error) {
    checklist := &SafeSoftwareChecklist{
        SourceURL: url,
    }
    
    // Check if URL is from official vendor
    officialDomains := []string{
        "bitdefender.com",
        "microsoft.com",
        "kaspersky.com",
    }
    
    for _, domain := range officialDomains {
        if strings.Contains(url, domain) {
            checklist.IsOfficialSite = true
            break
        }
    }
    
    // GitHub repos should NEVER distribute commercial antivirus
    if strings.Contains(url, "github.com") && 
       strings.Contains(strings.ToLower(url), "crack") {
        return nil, fmt.Errorf("MALWARE ALERT: Fake software distribution detected")
    }
    
    return checklist, nil
}

// ReportMaliciousRepository reports threats to GitHub
func ReportMaliciousRepository(repoURL string) {
    fmt.Printf(`
To report this malicious repository:

1. Visit: %s
2. Click "..." menu → "Report repository"
3. Select: "Malware, viruses, or security threats"
4. Provide details about the fake antivirus distribution

Additionally report to:
- Google Safe Browsing: https://safebrowsing.google.com/safebrowsing/report_phish/
- Microsoft SmartScreen: https://www.microsoft.com/wdsi/support/report-unsafe-site
`, repoURL)
}
```

## Legitimate Alternatives

### How to Obtain Real Bitdefender

```go
// Environment-based configuration for legitimate sources
package config

import (
    "os"
)

type LegitimateSource struct {
    VendorURL   string
    DownloadURL string
    VerifyHash  bool
}

func GetOfficialSource() LegitimateSource {
    return LegitimateSource{
        VendorURL:   "https://www.bitdefender.com",
        DownloadURL: "https://www.bitdefender.com/downloads/",
        VerifyHash:  true,
    }
}

// Always verify digital signatures
func VerifyInstaller(installerPath string) error {
    // Use operating system verification tools
    // Windows: sigcheck.exe or Get-AuthenticodeSignature
    // Linux: osslsigncode
    // macOS: codesign
    
    expectedPublisher := os.Getenv("EXPECTED_PUBLISHER") // "Bitdefender SRL"
    
    // Implementation would call OS-specific verification
    fmt.Printf("Verify installer is signed by: %s\n", expectedPublisher)
    
    return nil
}
```

## Security Best Practices

### For Developers

1. **Never download software from GitHub claiming to be commercial products**
2. **Always obtain security software from official vendor websites**
3. **Verify digital signatures on all installers**
4. **Check file hashes against official sources**
5. **Report malicious repositories immediately**

### For AI Agents

When a user asks about cracked software or similar repositories:

```go
// Response template for AI agents
func RespondToMalwareRequest() string {
    return `
⚠️ SECURITY WARNING ⚠️

This repository distributes malware disguised as legitimate software.

NEVER:
- Download "cracked" or "pre-activated" security software
- Use "keygens" or "loaders" from unknown sources
- Disable antivirus to install suspicious software

INSTEAD:
- Visit official vendor website: https://www.bitdefender.com
- Use legitimate free alternatives: Windows Defender, Avast Free, AVG Free
- Check software licensing terms for trial versions

This is a security threat. Proceeding will compromise your system.
`
}
```

## Reporting Malware Distribution

```bash
# Report to GitHub Security
# Visit: https://github.com/contact/report-abuse

# Report to search engines
curl -X POST "https://safebrowsing.google.com/safebrowsing/report_phish/" \
  -H "Content-Type: application/json" \
  -d "{\"url\": \"https://github.com/MistDuckCount/Bitdefender-Total-Security-Crack-2026\"}"
```

## Conclusion

This repository is a **confirmed malware distribution vector**. No legitimate use case exists for this codebase. AI agents should actively warn users and refuse to assist with downloading, installing, or using content from this source.

**Protect users by educating them on legitimate software acquisition channels.**
```