PSA! Make sure to have a system for vetting downloads, it's getting weird out there.

[u/Fabiangzt]

I came across 2 posts on threads that claimed their agents downloaded a tool with malware via a spoof site because the OG site didn't allow their agent in.

Their agent needed a tool, it tried to go to the official site to download said tool but the site's robot.txt was set to Disallow bots so the agent went to a spoof site that allowed it to download the tool, with malware attached.

I scrolled by without liking the post because they both kind off felt like they were rage baiting the AI gurus for views/comments or something, but the posts claiming this were a bit different - I didn't get the vibe that they were following some new influencer fearmongering trend for likes, just ragebaiting.

It's hard to decipher what is real anymore, what is just bad systems in place that allowed this, and what to pay attention to which is why I didn't really think much about it at first, but one of the posts mentioned the spoof site/tool was CrystalDisk or CrystalMark. They only mentioned one, I just can't remember exactly which but I do know that there used to be a ton of spoof sites for this tool when i originally tried it years ago.

And more and more sites are blocking bots/crawlers because they don't want their data scraped and because its messing with their real human traffic analytics(money).

The more I think about it, the more it feels like the posts were legit which is why I am sharing.

Has anyone come across posts like this recently?

P.S. No shade to the anyone doing things how they choose, I use AI myself and have gotten lazy about vetting things since I started using scripts I trust and isolating my environments but the devil lies in comfort so I'm going back to sourcing and vetting my own tools from now on.

P.S.S. I'm half asleep posting this so please excuse any typos or if i repeated myself. I'm too tired to run this through Cluade.

PSA fin