THREATNOIR
Subscribe
Back to Feed
MalwareApr 5, 2026

Around 2 hours ago (01:22EST) it appears ILSpy WordPress domain was compromised to deliver malwar...

ILSpy WordPress domain compromised to deliver malware instead of legitimate tool.

Read at source
Vendor Watch

Run ILSpy?

Get an email when a reviewed story names ILSpy, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works

Summary

The WordPress domain hosting ILSpy, a popular .NET decompiler tool, was compromised and began distributing malware to users attempting to download the software. The attack redirected users away from the legitimate GitHub repository, potentially affecting users who relied on the compromised domain for downloads. The domain subsequently returned a 502 error, suggesting the compromise was detected and mitigated.

Indicators of Compromise

  • domain — ilspy.wordpress.com

Entities

ILSpy (product).NET decompiler (technology)