KaoruAK

The context is that the program I analyzed is the official WhatsApp installer, unmodified, downloaded from https://www.whatsapp.com/download?lang=es . Which means the WhatsApp supply chain is infected. Or WhatsApp was hacked.

Hello, this is a project that goes beyond Bitcoin’s level of decentralization. In the GitHub repository there is a .zip file. Once you extract it, there will be a folder. Inside that folder, you need to go to the distil directory. There you will find an .exe file — this is the program you need to run. It is 100% decentralized and does not have a single seed server.

Project Omega Implementation Test: https://osf.io/zft2n/files/fsz2m

The 'both were just signed' argument fails to address the structural anomalies. If Microsoft signed both, why does the malware use RSA-2048 while the official binary uses RSA-4096?. Furthermore, the malware carries a compilation timestamp from the year 2097, an APT technique to evade security filters. We aren't just seeing 'two signed files'; we are seeing a malicious binary (verified with sandbox escape and session theft) that shouldn't exist in Microsoft's signing pipeline, yet it carries a valid signature and was delivered via a zero-click attack from an official CDN. This points directly to a compromise of the trust infrastructure (Key compromise, CA breach, or verification bypass), not a routine signing event