There have been multiple reported cases over the last month, as can be seen on the following thread for example:
Please disable Fake ANNs download links , theymos !.
Basically, scammers are cloning Ann threads, preserving the content of the original OP, but changing the links to their wallet download on (usually) GitHub. The account that do this are of multiple nature: New accounts, ranked accounts that were dormant and have recently woken-up, and hacked accounts with a certain rank (not necessarily higher than Member).
Some of these hacked accounts were silently hacked, meaning by this that they managed to gain control of the account without actually taking over it (no change of password nor email). They then posted the fake Anns on from these accounts and left the legitimate owner to face the problem once someone reported the fake Ann posted from his account.
