Report Malware and Suspicious Links here so Mods can take Action !

[Z_MBFM]

The user barry11- Account link: https://bitcointalk.org/index.php?action=profile;u=2038418 < Ban this user immediately

Op is promoted a trading platform. Thread link - BFCX Official Launch Announcement – Join the Future of Trading Now!

This users wake up after a long year. His/her last post was October 17, 2018. Maybe this is a hacked or a farm account

albon Already posted about this case,The same user is doing the same thing with his other account.

VirusTotal scan link: https://www.virustotal.com/gui/file/3a2f592550999e320125196565ca08d3f199efed8252bfaa0e3716f29c027cc0/detection

Jotti's malware scan link:
https://virusscan.jotti.org/en-GB/filescanjob/9dkvr2zzqd

Screenshot of the final scan result:

[God Of Thunder]

Ten Connected Account Spreading/Spamming with scam threads all over the forum

Account: Eskanekar, Norobilox, Branpakin, Calobitol, Urnocoutov, Leraqadar, Frinjukin, Boraledor, Erraleral, Yerakitis <= Should be ban immediately

Oh, so there's nothing new here. I just found a locked thread in the Gambling section created by a brand new account with a clickbait title. The title is similar to what you posted in the picture. I was about to click the link, but then noticed the domain name. It doesn't look like any forum or anything. It seems the website is a file hosting website where they have uploaded malware. Interestingly, Virustotal didn't detect any virus. But I didn't dare to visit the link.

Thread: Changelly exchange exploit (almost 30% more on BTC swaps)
User: Fennvukron

Edit: Quickly handled by the moderators 

[N.O]

We have found a new Fake Ann Topic for SURN-Network with malware download links

Account Link: Sketztrophonic <<< Please Ban this Account

Fake Ann topic: [ANN] SURN-NETWORK - Kaspa fork with new features (GPU PoW/ghostDAG)

Code:

https://github.com/surn-network/surn/releases/tag/1.1.2

Virustotal report: https://www.virustotal.com/gui/file/a60ed3f8df756ef033da69bdce7c3758f236254ead4922356c084c802e3a7675?nocache=1

This post is used as reference for Github Report!

[Crypto Library]

Another suspicious topic like it is just like the previous malware spreader thread format, but the interesting thing is currently Virustotal is giving false positive result on the check, may be they have find the way to bypass Virustotal? 

Ann Topic: [ANN] SELANIUM - Kaspa fork with new features (GPU PoW/ghostDAG)

Account Link : theinvestdude (the account is looks like hacked or sold as after 2022 this is the first post and also woke up on  5/6/2025 3:37:58 AM   )

[Lafu]

Another suspicious topic like it is just like the previous malware spreader thread format, but the interesting thing is currently Virustotal is giving false positive result on the check, may be they have find the way to bypass Virustotal?  

Ann Topic: [ANN] SELANIUM - Kaspa fork with new features (GPU PoW/ghostDAG)

Account Link : theinvestdude (the account is looks like hacked or sold as after 2022 this is the first post and also woke up on  5/6/2025 3:37:58 AM   )

I dont what file you have scanned or look for but i have checked the Windows Wallet File from that Github and i can say its for sure not false positiv !
If you look at some kind of things like that , look at when was the Github Account created in this case it was just yesterday.
Another way is to take a look at the behavior on Virustotal this takes some time to detect things.

Fake Github : github.com/selanium-chain

On top of that the Virustotal has dected this :

Code:

Malicious_Behavior.SB
Malware.SwollenFile!1.E38A (CLASSIC)
Trojan:W32/GenInflated.B

New RUN Key Pointing to Suspicious Folder
CurrentVersion Autorun Keys Modification
Potential Persistence Attempt Via Run Keys Using Reg.EXE
Direct Autorun Keys Modification
Load Of RstrtMgr.DLL By An Uncommon Process

Source : https://www.virustotal.com/gui/file/4d4177d898d891b9d69cad5caf10dd62ac2bc4063a4141cf0e3e0245de580a6e/detection

But yes you are right here that the Topic you mentioned is a Fake Ann and also a Fake Github Account !

[acroman08]

Looks like there's another batch(I think) of malicious link spammers on gambling board. I already reported them.

Omrahoitoz
Welayuber

Hi,

I'm looking for an experienced developer who can create bots or scripts to automate an exploit process for me.

The script should:
- Automatically create a new swap
- Execute the exploit
- Wait for funds to arrive
- Swap the funds back to BTC
- Repeat the process continuously, 24/7, without any manual intervention

Code:

Details of the exploit: https://gofile.io/d/cLlkij

If you're capable of building this, please send me a direct message here with your pricing. Thank you!

[Mitchell]

Yeah, they always start when I'm sleeping. My bot did report them, properly dealing with them now.

[mole0815]

Yeah, they always start when I'm sleeping. My bot did report them, properly dealing with them now.

Amazing - the scammers now even know when you're asleep? But luckily the bot does the work even during your well-deserved absence

[Mitchell]

Amazing - the scammers now even know when you're asleep? But luckily the bot does the work even during your well-deserved absence

Think it's just an unfortunate timing issue

[$crypto$]

Another fake thread from BonkPOW

account: themistocleess please ban
fake ANN: [ANN] BonkPOW | New PoW coin . No ICO. No Masternode

Code:

Windows(beta): https://github.com/bonk-pow/bonk-pow/releases/download/1.1/BonkPOW-v1.1.zip

[Zaka1221]

Hello Scam Busters,

Again and again Today hacked/sold account thienlonghue has created again fake project of Bitkini and also has added fake wallet links in topic which contain popular Trojan virus and other virus too. I hope you all will do your research on this topic and take action against thienlonghue and also remove scam topic.

Topic Link: [ANN] Bitkini (КINI) | Bitcoin Fork | 60s Blocks | Halvings | 31.35M Max Supply

Reference: https://www.virustotal.com/gui/file/91784da1de729e6055fa651322e3ec22672e01a41703742adc27236249d5e424?nocache=1

Fake File:

Code:

https://github.com/bitkini-lol/bitkini/releases/download/1.1/Bitkini-core-setup.zip

[Zaka1221]

Today I have returned to this thread with new report. User NitroPool has created  topic about fake project and included harmful virus download links in that fake topic. Download links contain many viruses Trojan virus and also other several harmful viruses. I request moderators and other members to investigate this fake topic and take action against user and topic accordingly.

Topic Link: [ANN] NitroPool.net – Multi-Algo PoW Mining Pool | SOLO + PROP | ASIC + CPU

Reference: [1] https://www.virustotal.com/gui/file/7b20ae5d4f8974a43418568566633f449bc29d7abd6d0ff7bdb08672abcdcf56?nocache=1
[2] https://www.virustotal.com/gui/file/37675ce300c7b954130c77ffb47d48c5bb1b45bed85131ee23e4852cec4d28cb?nocache=1

Fake File:

Code:

https://github.com/No-F8/cpuminer-opt-nitro/releases/tag/v25.3

[Lafu]

Today I have returned to this thread with new report. User NitroPool has created  topic about fake project and included harmful virus download links in that fake topic. Download links contain many viruses Trojan virus and also other several harmful viruses. I request moderators and other members to investigate this fake topic and take action against user and topic accordingly.

Topic Link: [ANN] NitroPool.net – Multi-Algo PoW Mining Pool | SOLO + PROP | ASIC + CPU

Reference: [1] https://www.virustotal.com/gui/file/7b20ae5d4f8974a43418568566633f449bc29d7abd6d0ff7bdb08672abcdcf56?nocache=1
[2] https://www.virustotal.com/gui/file/37675ce300c7b954130c77ffb47d48c5bb1b45bed85131ee23e4852cec4d28cb?nocache=1

To be honest and when i really appreciate your efford for looking out for this kind of things like Malware and Trojans , Virus you  are wrong here.
There is nothing special or strange when you look at the Virustotal detections , this what you see there is callled False Positiv.
At first it looks like that there are some bad things but its all needed for a Miner and also Virustotal declares and flaggs it as an Miner.
For sure there can be any time and in any file something , but if you look at all the other Miner Software you will be find nearly the same detecions.

[Z_MBFM]

The user ishaqsd- Account link: https://bitcointalk.org/index.php?action=profile;u=2151285 < Ban this user immediately

Op is promoted a Phishing software. Thread link - [ANN] Moreover ♻️ Asset Layer for Bitcoin-Lightning ✔️ | Secure DeFi | No ICO

Code:

Download the latest wallet release from GitHub: 
   https://github.com/EvrmoreOrg/Evrmore/releases/tag/v2.0.0test
Choose the version appropriate for your OS ([b]Windows, macOS, Linux[/b])

Windows

Reference - https://www.virustotal.com/gui/file/1ae975f9f978be2bae9f973e743d505b5052ff67ecbaf77ee5b9a8eb4b9128e3

Linux

Reference - https://www.virustotal.com/gui/file/a71ffead53f3efb0b0f4ff889061f382b3d584d34b001e095c0e84239c548585

[Mitchell]

As always thank you for reporting

[$crypto$]

Fake Threads that spread Malware

account: vincentallstar please ban
Fake ANN: [ANN] Globe | Scalable EVM + AI Assistant | Bulletproof Privacy | Fair Launch

Code:

[b]Wallet:[/b] https://github.com/globecurrency/GLOBE/releases/download/1.0.0/GLOBE-1.0.0-win64-setup.zip

Fake Github: github.com/globecurrency/GLOBE
Original Github: github.com/globe-project

[Lafu]

As always thank you for reporting

Yeb also from my side i want to thank you to all that are hit the " Report to Moderator " button abd reporting this kind of things and also write here.
I really appreciate every single User that are doing that and helps me and the whole Forum to hopefully safe others and New users for getting infected and mostly hacked.
Sometimes i dont have enough time to watch all the time this Fake Anns and to write here , so thank you very much to all who help me to fight this shady guys that are posting this Malware shit.

[Zaka1221]

To be honest and when i really appreciate your efford for looking out for this kind of things like Malware and Trojans , Virus you  are wrong here.
There is nothing special or strange when you look at the Virustotal detections , this what you see there is callled False Positiv.
At first it looks like that there are some bad things but its all needed for a Miner and also Virustotal declares and flaggs it as an Miner.
For sure there can be any time and in any file something , but if you look at all the other Miner Software you will be find nearly the same detecions.

Thank so much @Lafu for explanation. I am new to this field and trying to learn new things on this forum. I find malware detection quite interesting and I do not have much knowledge about that. I am trying to learn more in futur and I can help to protect forum from malware threats.

That’s why if I notice any malicious activity in ANN thread instead of directly reporting it to moderator I submit it in this thread so that you and other professional scam busters do your research and take action against malicious threats.

I would request you please share with me any topic or website link where I can learn more about this subject so I can continue my research and improve my understanding.

Also I am submit another report here because I noticed some suspicious activity in this topic. hope this time I am not wrong and I believe there is Trojan virus (Trojan.Win64.Agent) present in the GitHub file which is bad thing. Please take a look at this report.

User: worldcoinCPU

Topic Link: [ANN] Worldcoin (WRD): Reclaiming Crypto with a New Proof of Work

Reference: https://www.virustotal.com/gui/file/7cf298ddb9ce996251599693388f0446c0a2c7c7bfe87d8299bf4d2291665304/detection

Fake File:

Code:

https://github.com/kryptoin/Worldcoin

[Lafu]

Thank so much @Lafu for explanation. I am new to this field and trying to learn new things on this forum. I find malware detection quite interesting and I do not have much knowledge about that. I am trying to learn more in futur and I can help to protect forum from malware threats.

You are very Welcome , and to be honest its ncie and good to see that other Users and people care about that things also.
First i want to let you know even you trie at you very hardest you cant protect all Users or give them the warning , because nowadays there is for everything no time.
The Issue is that all or the most dont ckeck the Links or question the Links they are seen.

I submit it in this thread so that you and other professional scam busters do your research and take action against malicious threats.

Even you are not sure about some Topic or post you see , you can post it here and for sure it will be looked at it.

I would request you please share with me any topic or website link where I can learn more about this subject so I can continue my research and improve my understanding.

If you want to learn about that all read this Topic from the first post on.
Every User have different skills and some style to report and find some kind of things , in the end the whole community works together to catch the shady things.

[MiningCoinsPool]

Same guy again, same pattern, same alerts in virustotal:
https://bitcointalk.org/index.php?topic=5552319.0

https://www.virustotal.com/gui/file/93027258595d6ca50810ca2cac51cf42ae7b7ff464587f901c1aa75cc01a0187/relations