A fake FileZilla site hosts a malicious download

A trojanized portable copy of FileZilla 3.69.5 is being distributed from a lookalike domain (filezilla-project.live); the archive contains a malicious version.dll that uses DLL search order hijacking to load inside filezilla.exe, harvest saved FTP credentials, and call back to C2 infrastructure via DNS-over-HTTPS (welcome.supp0v3.com) and a secondary TCP server at 95.216.51.236:31415. The loader includes anti-analysis checks, proxying behavior, and persistence-related actions; Malwarebytes provides hashes, domains, and network indicators and recommends verifying official downloads, checking for version.dll in FileZilla folders, and blocking the listed IOCs.