A new trojan has been spotted by Twitter users 0day enthusiast (@impost0r_) and MalwareHunterTeam (@malwrhunterteam) using the popular open-source debugger dnsSpy. This application allows developers and malware researchers to debug and decompile .NET programs. The software is no longer under active development, though it is freely available on GitHub for anyone to clone and update it. One (1) of these clones that appear to be under active development was found to have a “cocktail” of malware included in the software. While it functions normally, when executed it runs a series of commands with elevated privileges. These commands include disabling Microsoft Defender, downloading the application cURL, using cURL to download a “variety of payloads” onto the machine, and disabling User Account Control. While most of the payloads are unknown, some of the known malware downloaded include a clipboard hijacker, a cryptocurrency miner, the Quasar RAT, and a legitimate program used to disable Microsoft Defender. The group behind this trojan created a website to advertise the malicious application. Using search engine optimizations (SEO), it began to appear on the first and second result when googling the keyword “dnsSpy” and even bought ads to make the malware always appear as the first result. With the increase of trojans targeting developers and security researchers, specifically by North Korean hackers, it is clear there is a market for this type of malware and these tech enthusiasts must keep their guard up when downloading applications.