THREATNOIR
Subscribe
Back to Feed
MalwareApr 5, 2026

Around 2 hours ago (01:22EST) it appears ILSpy WordPress domain was compromised to deliver malwar...

ILSpy WordPress domain compromised to deliver malware instead of legitimate tool.

Read at source

Summary

The WordPress domain hosting ILSpy, a popular .NET decompiler tool, was compromised and began distributing malware to users attempting to download the software. The attack redirected users away from the legitimate GitHub repository, potentially affecting users who relied on the compromised domain for downloads. The domain subsequently returned a 502 error, suggesting the compromise was detected and mitigated.

Indicators of Compromise

  • domain — ilspy.wordpress.com

Entities

ILSpy (product).NET decompiler (technology)