Attackers are using multiple channels — including GitHub, YouTube, and VirusTotal — to build an illusion of trust to spread fake tools that hide malware.