THE CURIOUS CASE OF THE TRITON MALWARE FORK

Summary from the TLDR InfoSec newsletter

A suspicious fork of the Triton macOS omg.lol client turns out not to be simple plagiarism, but a clumsy malware delivery attempt hosted on GitHub. The attacker floods the README with links to a Windows-only malware ZIP hidden in an Xcode asset path, then pads the GitHub contribution graph with fake backdated commits to appear legitimate. Sandbox analysis shows a multistage Windows infection chain using 7zip, LuaJIT, anti-analysis tricks, and C2 traffic masquerading as Microsoft and blockchain traffic.