pmintel.report
← all digests
Jul 5, 2026daily

460KB Malware Clone Wave Hits Polymarket Bot Repos

A coordinated campaign of identical 460KB cloned malware template repositories is flooding public bot listings, with garbled usernames and plausible descriptions used as cover. Operators pulling new repos today should treat anything matching the 460KB fingerprint as compromised until proven otherwise.

460KB Clone Wave Is Today's Lead Threat

A coordinated malware distribution campaign is the most important operational story of July 5th. Three separate alerts converged on the same threat signature: identical 460KB repository clones, garbled or randomized usernames, and legitimately written descriptions designed to pass casual inspection. This is not noise — the pattern across all three alerts indicates an automated cloning pipeline targeting prediction market operators who pull and run repos without auditing. If you cloned anything in the last 48 hours, cross-reference the repo size. 460KB is your kill signal. Do not run it. Do not inspect it on a machine with active API keys or wallet credentials loaded.

---

New Bots Worth Examining (8 Found, 8 Viable)

Today's sweep turned up a clean haul. All eight repos flagged came back worth-cloning, zero confirmed malware among them — a strong day on net, once you subtract the clone campaign above.

**auspex** is the most technically interesting find. It runs trigger-based market screening with a resolution confidence scoring layer, specifically built for crypto event markets. The distance-to-trigger analysis is the differentiator — it ranks markets by how close they are to a resolution trigger, which is a smarter queue than sorting by volume or closing time alone.

**polymarket-whale-tracker** does what the name says: identifies high-value wallets, tracks their activity, and generates copy-trade signals automatically. Combined with today's alpha callouts (see below), this tool becomes more interesting.

**predict_arb_public** targets the Predict.fun / Polymarket spread. Cross-platform arbitrage on prediction markets is still underexplored relative to crypto DEX arb. If the price discovery between platforms lags, this bot is positioned to capture it with a market-making layer on identified discrepancies.

**alphaedge** takes a different delivery approach — browser extension rather than standalone bot. It runs mispricing detection alongside smart money flow analysis in-browser, which lowers the ops overhead but raises questions about key handling you should audit before use.

**FIFAWorldCup** is the most forward-looking find given the 2026 tournament calendar. Ensemble ML with Monte Carlo simulation to price match outcomes is a legitimate methodology. With the tournament approaching, markets will open and early inefficiencies tend to be the largest. Get familiar with this one now.

---

Alpha Signals: $10M Wallet Confirmed, Weekly Scalper Identified

Two separate callouts today identified the same Polymarket account carrying $10M+ in profit over two years. The double confirmation across independent signals increases confidence this is real, not a reporting artifact. If you run a whale tracker, this wallet should be in your watchlist immediately.

Separately, a trader showing +$36K in a single week on 5-minute BTC resolution markets with four consecutive green months was flagged. Short-interval crypto markets are a specific skill set — this is not someone getting lucky on election calls. The 5-minute BTC market edge is worth reverse-engineering.

---

Strategy Intelligence

The HN thread on **"Nothing Ever Happens"** — a bot that always buys No on non-sports markets — cresting 471 points is worth noting strategically. The strategy is a joke that isn't entirely a joke. Base rates on dramatic resolution events are low. If that bot is running live and profitable, it's a data point about how much alpha exists in non-sports markets versus how much operators think exists.

The Spain regulatory block on Polymarket and Kalshi (1,083 points) is a compliance flag for any operators with European user exposure or infrastructure.

---

What to Watch