{
  "name": "The Curious Case of the Triton Malware Fork",
  "slug": "the-curious-case-of-the-triton-malware-fork",
  "description": "A malicious fork of the MacOS app Triton was discovered on GitHub, containing Windows-targeted malware disguised as the legitimate application. The attacker modified the repository, redirecting download links to a ZIP file hosting the malware. Analysis revealed sophisticated evasion techniques, anti-analysis features, and potential cryptocurrency functionality. The low detection rate and peculiar implementation suggest either an amateur attempt or a possible AI-generated attack. The incident highlights broader concerns about GitHub's security practices and Microsoft's priorities, prompting a call for developers to consider alternative code hosting platforms that better align with open-source values and user privacy.",
  "published": "2026-02-19T14:26:26+00:00",
  "created_at": "2026-02-19T14:26:26+00:00",
  "modified_at": "2026-02-19T17:13:19+00:00",
  "created_at_opencti": "2026-02-19T14:26:26+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-02-19",
    "code-hosting",
    "fork",
    "github",
    "macos",
    "malware",
    "open-source",
    "triton",
    "triton malware fork",
    "windows"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "89.169.12.160"
      },
      {
        "id": "",
        "name": "http://89.169.12.160/api/NTEsN2QsN2UsNTgsNWIsNjAsNjIsNjcsYyw3OSw="
      },
      {
        "id": "",
        "name": "39b29c38c03868854fb972e7b18f22c2c76520cfb6edf46ba5a5618f74943eac"
      }
    ],
    "malware": [
      {
        "id": "cccdb840-e38b-4af4-9791-02d124007fee",
        "name": "Triton malware fork",
        "slug": "triton-malware-fork"
      }
    ],
    "attack_patterns": [
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "omg.lol"
      }
    ]
  },
  "external_refs": [
    "https://brennan.day/the-curious-case-of-the-triton-malware-fork",
    "https://otx.alienvault.com/pulse/69972ba2882e7d9de0dc29f9"
  ]
}