Ohey: FileDrop kit runs fake BleachBit, FileZilla and Notepad++ download sites such as bleachbitsoftware.com
Ohey researcher @KirkDerpca reported on 1 November 2026 that the FileDrop kit runs fake download sites for free tools like BleachBit, FileZilla and Notepad++. Ohey advises downloading only from each project's own site.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Researcher Kirk (@KirkDerpca) of the web-threat intelligence firm Ohey posted on X on 1 November 2026 about FileDrop, a kit behind fake software download sites, and linked Ohey's research page. According to Ohey, FileDrop sites copy the download pages of free Windows tools: BleachBit, CrystalMark, FurMark, FileZilla, Notepad++, OBS, ShareX, Wise Care 365, Windhawk and privacy.sexy. The operators build the sites on lookalike domains such as bleachbitsoftware.com and file-zilla.com, and on Cloudflare Pages. Ohey says it has matched the kit on 13 sites since 28 October 2026. The real projects are not involved, and Cloudflare is a hosting service that is being misused.
How the scam works
On a FileDrop site, the Download button does not link to a file. According to Ohey, a click makes the page ask a Base blockchain contract for the address of the download server, which the operator can change at any time. The page then trades an encrypted handshake with that server for a one-time ticket and saves the reply as a ZIP file. While it downloads, a full-screen “How to install” box covers the page. Its five steps tell the visitor to wait for the download, right-click and choose Extract All, open the extracted folder, review the changes and run the file it names. Ohey reads two such contracts every day, which pointed to the servers secure-link.club and ficoso.click on 1 November 2026.
Using a blockchain contract to hold the server address makes the kit hard to take down, because the operator can move every site to a new server by changing one value. Ohey also notes that the server answered its own scanner's handshake with an error and issued no ticket, so its page does not describe what is inside the ZIP files.
Ohey's advice is to get each tool from its own project's website and to treat any computer that ran a file from a FileDrop ZIP as compromised.
Source
@KirkDerpca on X, post of 1 November 2026, and Ohey's research page “FileDrop: fake software downloads served from Base contracts”, counted on 1 November 2026. Not independently verified by scammers.com.
Red flags
- A look-alike download page for a free tool on an unofficial domain such as file-zilla.com or bleachbitsoftware.com.
- A Download button that gives a ZIP archive and not a normal installer.
- A full-screen “How to install” box telling you to extract the ZIP and run the file inside.
- Several differently named sites that copy the same open-source tool.
- A download page reached through an ad or search result instead of the project's own site.
If you were targeted
- 1Download BleachBit, FileZilla, Notepad++, OBS and similar tools only from each project's official website.
- 2If you ran a file from one of these ZIPs, treat the computer as compromised: disconnect it, scan it and change passwords from a clean device.
- 3Check the exact web address before downloading; do not trust a page just because it looks the same.
- 4Be wary of ZIP files that tell you to run an extracted program.
- 5Report fake software sites to the project and to the hosting provider.