Hackers Compromised ILSpy WordPress Domain to Deliver Malware

A supply-chain attack compromised the official ILSpy WordPress site on April 6, 2026: download links were altered to redirect visitors to a malicious page that prompted installation of a browser extension delivering spyware capable of stealing session cookies, passwords, and developer credentials. An independent researcher captured the activity, the compromised site was taken offline (returning 502), and security teams are analyzing the extension to extract IoCs; developers are advised to verify final URLs, avoid unexpected extensions, and download tools from verified repositories.