malware-distribution-detection

Imported from reason-machines/security-skills (skills/malware-distribution-detection/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill malware-distribution-detection. Copyright stays with the author.

---
name: malware-distribution-detection
description: Detect and analyze malicious software distribution disguised as legitimate security tools
triggers:
  - identify fake antivirus repositories
  - detect malware distribution on github
  - analyze suspicious crack downloads
  - recognize pirated security software
  - spot trojan delivery mechanisms
  - validate legitimate security tools
  - check for malicious installers
  - investigate software supply chain attacks
---

# Malware Distribution Detection

> Skill by [ara.so](https://ara.so) — Security Skills collection.

## ⚠️ Critical Security Warning

**This repository is a MALWARE DISTRIBUTION VECTOR.** It masquerades as legitimate Bitdefender Total Security software but is designed to distribute malicious payloads including trojans, ransomware, and information stealers.

## Threat Indicators

### Red Flags Present in This Repository

1. **Illegal Software Distribution**: Claims to provide "cracked" commercial antivirus software
2. **Activation Bypass**: References to "keygen", "loader", "pre-activated" indicate malware
3. **Defender Bypass**: Explicitly mentions bypassing Windows Defender - a malware characteristic
4. **SEO Manipulation**: Excessive use of keywords to appear in search results
5. **No Legitimate Code**: Repository contains no actual Go code despite claiming Go as primary language
6. **Suspicious Growth**: Artificial star accumulation (59 stars in 14 days)
7. **Missing Documentation**: No README or legitimate project files

### Common Malware Distribution Patterns

```go
// DO NOT USE - Example of detection logic for identifying fake software repos

package detector

import (
    "regexp"
    "strings"
)

type ThreatIndicator struct {
    Pattern  string
    Severity string
    Category string
}

var MalwareIndicators = []ThreatIndicator{
    {Pattern: "crack|keygen|loader|pre-activated", Severity: "CRITICAL", Category: "Software Piracy"},
    {Pattern: "defender-bypass|bypass", Severity: "CRITICAL", Category: "AV Evasion"},
    {Pattern: "license key|activation|serial", Severity: "HIGH", Category: "Credential Theft"},
    {Pattern: "full version free|premium free", Severity: "HIGH", Category: "Social Engineering"},
}

func AnalyzeRepository(description string, topics []string) []string {
    var threats []string
    lowercaseDesc := strings.ToLower(description)
    
    for _, indicator := range MalwareIndicators {
        matched, _ := regexp.MatchString(indicator.Pattern, lowercaseDesc)
        if matched {
            threats = append(threats, indicator.Category)
        }
    }
    
    // Check topics for suspicious keywords
    suspiciousTopics := []string{"defender-bypass", "thread-hijacking", "exploit-mitigation"}
    for _, topic := range topics {
        for _, suspicious := range suspiciousTopics {
            if topic == suspicious {
                threats = append(threats, "Malicious Topic: "+topic)
            }
        }
    }
    
    return threats
}

Detection Strategies

Repository Analysis

package scanner

import (
    "context"
    "fmt"
)

// RepositoryScanner checks GitHub repositories for malware distribution signs
type RepositoryScanner struct {
    RepoURL     string
    Description string
    Topics      []string
    HasReadme   bool
    HasCode     bool
    Language    string
}

func (rs *RepositoryScanner) EvaluateThreatLevel() string {
    score := 0
    
    // No README is suspicious
    if !rs.HasReadme {
        score += 2
    }
    
    // No actual code in primary language
    if !rs.HasCode {
        score += 3
    }
    
    // Keyword analysis
    suspiciousKeywords := []string{"crack", "keygen", "bypass", "loader", "pre-activated"}
    for _, keyword := range suspiciousKeywords {
        if contains(rs.Description, keyword) {
            score += 2
        }
    }
    
    // Evaluate
    if score >= 5 {
        return "CRITICAL - Likely Malware Distribution"
    } else if score >= 3 {
        return "HIGH - Suspicious Activity"
    }
    
    return "NORMAL"
}

func contains(text, substr string) bool {
    return regexp.MustCompile("(?i)" + substr).MatchString(text)
}

User Protection Guidance

package protection

import (
    "fmt"
    "os"
)

// SafeSoftwareChecklist provides validation steps
type SafeSoftwareChecklist struct {
    SourceURL       string
    IsOfficialSite  bool
    HasValidCert    bool
    CommunityTrust  bool
}

func ValidateSoftwareSource(url string) (*SafeSoftwareChecklist, error) {
    checklist := &SafeSoftwareChecklist{
        SourceURL: url,
    }
    
    // Check if URL is from official vendor
    officialDomains := []string{
        "bitdefender.com",
        "microsoft.com",
        "kaspersky.com",
    }
    
    for _, domain := range officialDomains {
        if strings.Contains(url, domain) {
            checklist.IsOfficialSite = true
            break
        }
    }
    
    // GitHub repos should NEVER distribute commercial antivirus
    if strings.Contains(url, "github.com") && 
       strings.Contains(strings.ToLower(url), "crack") {
        return nil, fmt.Errorf("MALWARE ALERT: Fake software distribution detected")
    }
    
    return checklist, nil
}

// ReportMaliciousRepository reports threats to GitHub
func ReportMaliciousRepository(repoURL string) {
    fmt.Printf(`
To report this malicious repository:

1. Visit: %s
2. Click "..." menu → "Report repository"
3. Select: "Malware, viruses, or security threats"
4. Provide details about the fake antivirus distribution

Additionally report to:
- Google Safe Browsing: https://safebrowsing.google.com/safebrowsing/report_phish/
- Microsoft SmartScreen: https://www.microsoft.com/wdsi/support/report-unsafe-site
`, repoURL)
}

Legitimate Alternatives

How to Obtain Real Bitdefender

// Environment-based configuration for legitimate sources
package config

import (
    "os"
)

type LegitimateSource struct {
    VendorURL   string
    DownloadURL string
    VerifyHash  bool
}

func GetOfficialSource() LegitimateSource {
    return LegitimateSource{
        VendorURL:   "https://www.bitdefender.com",
        DownloadURL: "https://www.bitdefender.com/downloads/",
        VerifyHash:  true,
    }
}

// Always verify digital signatures
func VerifyInstaller(installerPath string) error {
    // Use operating system verification tools
    // Windows: sigcheck.exe or Get-AuthenticodeSignature
    // Linux: osslsigncode
    // macOS: codesign
    
    expectedPublisher := os.Getenv("EXPECTED_PUBLISHER") // "Bitdefender SRL"
    
    // Implementation would call OS-specific verification
    fmt.Printf("Verify installer is signed by: %s\n", expectedPublisher)
    
    return nil
}

Security Best Practices

For Developers

1. Never download software from GitHub claiming to be commercial products
2. Always obtain security software from official vendor websites
3. Verify digital signatures on all installers
4. Check file hashes against official sources
5. Report malicious repositories immediately

For AI Agents

When a user asks about cracked software or similar repositories:

// Response template for AI agents
func RespondToMalwareRequest() string {
    return `
⚠️ SECURITY WARNING ⚠️

This repository distributes malware disguised as legitimate software.

NEVER:
- Download "cracked" or "pre-activated" security software
- Use "keygens" or "loaders" from unknown sources
- Disable antivirus to install suspicious software

INSTEAD:
- Visit official vendor website: https://www.bitdefender.com
- Use legitimate free alternatives: Windows Defender, Avast Free, AVG Free
- Check software licensing terms for trial versions

This is a security threat. Proceeding will compromise your system.
`
}

Reporting Malware Distribution

# Report to GitHub Security
# Visit: https://github.com/contact/report-abuse

# Report to search engines
curl -X POST "https://safebrowsing.google.com/safebrowsing/report_phish/" \
  -H "Content-Type: application/json" \
  -d "{\"url\": \"https://github.com/MistDuckCount/Bitdefender-Total-Security-Crack-2026\"}"

Conclusion

This repository is a confirmed malware distribution vector. No legitimate use case exists for this codebase. AI agents should actively warn users and refuse to assist with downloading, installing, or using content from this source.

Protect users by educating them on legitimate software acquisition channels.