malware-detection-warning

Imported from reason-machines/security-skills (skills/malware-detection-warning/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill malware-detection-warning. Copyright stays with the author.

---
name: malware-detection-warning
description: WARNING - This repository appears to be a malicious software distribution attempt disguised as legitimate security software
triggers:
  - detect malicious repository patterns
  - identify software crack scams
  - recognize malware distribution tactics
  - analyze suspicious github projects
  - evaluate repository legitimacy
  - assess security software credibility
---

# Malware Detection Warning

> Skill by [ara.so](https://ara.so) — Security Skills collection.

## ⚠️ CRITICAL SECURITY WARNING

This repository exhibits multiple indicators of malicious intent and should **NOT** be used, downloaded, or interacted with.

## Threat Indicators

### 1. **Fraudulent Software Distribution**
- Claims to provide "cracked" or "pre-activated" commercial security software
- Violates Bitdefender's intellectual property and licensing terms
- No legitimate software vendor distributes cracks or keygens

### 2. **Social Engineering Tactics**
- Uses star emojis and promotional language to appear trustworthy
- Artificially inflated star count (59 stars) to establish false credibility
- Topics include "defender-bypass" and "thread-hijacking" - clear malicious indicators

### 3. **Red Flag Topics**
The repository tags itself with concerning topics:
- `defender-bypass` - explicitly aims to evade security software
- `thread-hijacking` - a malware technique
- `exploit-mitigation` - contradictory for a "cracked" security tool
- `rootkit-remover` - ironic given likely rootkit delivery mechanism

### 4. **Missing Critical Information**
- No README file (highly suspicious for legitimate software)
- No source code visible
- License marked as "NOASSERTION"
- Zero forks despite claims of popularity

## Actual Purpose

This repository likely serves one or more malicious purposes:

1. **Malware Distribution**: Downloads contain trojans, ransomware, or information stealers
2. **Credential Harvesting**: Collects system information or passwords
3. **Botnet Recruitment**: Installs backdoors for remote control
4. **Cryptocurrency Mining**: Hijacks system resources
5. **SEO Manipulation**: Ranks in searches for "Bitdefender crack" to distribute malware

## What To Do Instead

### For Legitimate Security Software:

```bash
# Visit official Bitdefender website only
https://www.bitdefender.com

# Use official package managers (example for Linux)
sudo apt-get install bitdefender-endpoint-security-tools

# For Windows, download from official site only
# Verify digital signatures on all installers

If You've Already Downloaded:

# Immediately disconnect from network
# Run full system scan with known-good antivirus from bootable media

# Check for persistence mechanisms (Windows)
# Review scheduled tasks
schtasks /query /fo LIST /v

# Check startup items
wmic startup get caption,command

# Review services
sc query state=all

# Linux/Mac - check cron jobs
crontab -l
sudo crontab -l

# Check for suspicious processes
ps aux | grep -i "bitdefender\|crack\|loader"

Reporting

Report this repository to:

• GitHub Trust & Safety: https://support.github.com/contact/report-abuse
• Bitdefender Security Team: https://www.bitdefender.com/consumer/support/contact-us.html
• Your local cybersecurity authorities

Educational Value

This repository serves as a case study in identifying malicious repositories:

Detection Checklist

suspicious_indicators:
  naming:
    - Contains "crack", "keygen", "loader", "activated"
    - Year in future (2026)
    - Legitimate company name + crack
  
  description:
    - Excessive emojis and promotional language
    - Claims of "full version" or "pre-activated"
    - Lists multiple OS versions
  
  repository_metadata:
    - No meaningful code visible
    - Missing or minimal README
    - Suspicious topic tags
    - Recent creation with artificial engagement
  
  technical_flags:
    - Topics include "bypass" or "hijacking"
    - Language doesn't match purpose (Go for Windows security?)
    - Zero forks despite stars

Pattern Recognition Code

package main

import (
    "regexp"
    "strings"
)

type ThreatIndicators struct {
    SuspiciousKeywords []string
    Score int
}

func AnalyzeRepository(name, description string, topics []string) ThreatIndicators {
    indicators := ThreatIndicators{
        SuspiciousKeywords: []string{},
        Score: 0,
    }
    
    // Check for crack-related terms
    crackTerms := []string{"crack", "keygen", "loader", "activated", "pre-activated", "bypass"}
    for _, term := range crackTerms {
        if strings.Contains(strings.ToLower(name), term) || 
           strings.Contains(strings.ToLower(description), term) {
            indicators.SuspiciousKeywords = append(indicators.SuspiciousKeywords, term)
            indicators.Score += 25
        }
    }
    
    // Check for malicious technique topics
    maliciousTopics := []string{"bypass", "hijacking", "exploit"}
    for _, topic := range topics {
        for _, malTopic := range maliciousTopics {
            if strings.Contains(strings.ToLower(topic), malTopic) {
                indicators.SuspiciousKeywords = append(indicators.SuspiciousKeywords, topic)
                indicators.Score += 20
            }
        }
    }
    
    // Check for legitimate company name misuse
    legitimateCompanies := []string{"bitdefender", "kaspersky", "norton", "mcafee"}
    for _, company := range legitimateCompanies {
        if strings.Contains(strings.ToLower(name), company) {
            indicators.Score += 15
        }
    }
    
    return indicators
}

Legitimate Alternatives

Free Antivirus Options:

• Windows Defender (built-in, free, legitimate)
• Bitdefender Free Edition (official)
• Avast Free Antivirus
• AVG Free Antivirus

Paid Security Suites (Official Sites Only):

• Bitdefender Total Security (official subscription)
• Kaspersky Internet Security
• ESET Internet Security
• Norton 360

Summary

DO NOT USE THIS REPOSITORY. It is a malware distribution attempt masquerading as cracked security software. Always obtain software from official vendors, especially security tools. The presence of terms like "crack," "keygen," and "pre-activated" combined with security software is a guaranteed indicator of malicious intent.