Malicious counterfeit of 200,000-star REA: Fake installation package flagged as malware, downloaded 172 times.

Beating AI News Flash: The viral AI reverse tool REA has been maliciously counterfeited. On October 13, a developer issued a warning in REA’s official GitHub repository, noting that a fake repository had been set up offering a Windows installer suspected of containing a Trojan horse. REA recently surpassed 200,000 GitHub stars, and the fake installer had amassed 172 downloads at the time of reporting. The counterfeiter registered a GitHub repository named `rea-tools/rea`—closely resembling REA’s official website `rea.tools`—and directly copied the official README. They added a "Windows Standalone Version" download entry to the original documentation, providing an 82.6 MB compressed package. The reporter’s scan found that Microsoft Defender flagged both the compressed package and its executable as the Wacatac Trojan, with 8 out of 45 VirusTotal security engines marking it as malicious. Sandbox analysis also uncovered suspicious behaviors in the file, including debugging environment detection and delayed execution. REA’s maintainers then merged a fix pull request (PR) on October 13, adding a download source warning to the official README to remind users to obtain the software via the official GitHub repository, official website, or npm. The reported fake repository is currently inaccessible.