Security notice: download Hookshot only from this repository's Releases #1307

Open

opened 2026-11-09 21:26:45 +00:00 by NotRexed · 0 comments

NotRexed commented

2026-11-09 21:26:45 +00:00

(Migrated from github.com)

Hookshot is only distributed at https://github.com/NotRexed/Hookshot/releases. Copies anywhere else (Discord DMs, YouTube links, download sites, "repacks", bundles with game files or "shader packs") are not from this project.

Check your download. The official v2.0.11 files and their SHA-256 hashes (PowerShell: Get-FileHash <file>):

File	SHA-256
`HookshotBuilder.exe`	`d085bd291c5e68ab33b88b0a03be3671a76987b0998b9a881b2d36390175b09b`
`hookshot-setup.txt`	`aeac668f095159d76a904c9780ba044843e4a0e16e63025d3b932f01cff6f333`
`Hookshot-v2.0.11-x86_64.AppImage`	`5863f9dcea4f8d8e63fedd31f371706da13891e86990207e34077948e3346e01`

The installer checks every part it downloads against the SHA-256 listed in hookshot-setup.txt.

Hookshot never:

asks for a Discord, Instagram or any other login, a token or a password,
asks for administrator rights,
talks to anything but github.com and api.github.com while installing.

About Windows Defender: Trojan:Win32/Wacatac.B!ml on HookshotBuilder.exe is a known false positive (#1003). The !ml suffix means it's a machine-learning guess about a small unsigned installer, not a match against known malware.

If you think a download stole your accounts, open an issue with:

where you got the file (the exact link),
its SHA-256,
the VirusTotal link (the link only, not the file).

Also change your passwords and sign out all sessions from a clean device.

**Hookshot is only distributed at https://github.com/NotRexed/Hookshot/releases.** Copies anywhere else (Discord DMs, YouTube links, download sites, "repacks", bundles with game files or "shader packs") are not from this project. **Check your download.** The official v2.0.11 files and their SHA-256 hashes (PowerShell: `Get-FileHash <file>`): | File | SHA-256 | |---|---| | `HookshotBuilder.exe` | `d085bd291c5e68ab33b88b0a03be3671a76987b0998b9a881b2d36390175b09b` | | `hookshot-setup.txt` | `aeac668f095159d76a904c9780ba044843e4a0e16e63025d3b932f01cff6f333` | | `Hookshot-v2.0.11-x86_64.AppImage` | `5863f9dcea4f8d8e63fedd31f371706da13891e86990207e34077948e3346e01` | The installer checks every part it downloads against the SHA-256 listed in `hookshot-setup.txt`. **Hookshot never:** - asks for a Discord, Instagram or any other login, a token or a password, - asks for administrator rights, - talks to anything but github.com and api.github.com while installing. **About Windows Defender:** `Trojan:Win32/Wacatac.B!ml` on `HookshotBuilder.exe` is a known false positive (#1003). The `!ml` suffix means it's a machine-learning guess about a small unsigned installer, not a match against known malware. **If you think a download stole your accounts,** open an issue with: - where you got the file (the exact link), - its SHA-256, - the VirusTotal link (the link only, not the file). Also change your passwords and sign out all sessions from a clean device.

Commenting is not possible because the repository is archived.