Spain bans Polymarket; malware template resurfaces in wild

Spain Pulls the Plug — And a Malware Template Is Back in Circulation

Two stories dominate today's digest and neither is good news for operators running unattended infrastructure. Spain has formally blocked Polymarket and Kalshi, citing absence of a domestic gambling licence. This is not a grey-area enforcement action — it is a hard block, and it signals that European regulatory pressure, dormant for much of 2025, is moving again. If you are routing traffic through EU-based infrastructure or serving Spanish-resident accounts, audit your exposure now. More jurisdictions will be watching this outcome.

---

New Bots Found

**None.** Zero new repositories worth monitoring were identified today. The garbled-username spam campaign (see Security section) generated noise but no deployable code of value.

---

Security Alerts — Read This Section

Three distinct threat signals converged today. Treat this as an elevated-risk period for the ecosystem.

**1. Garbled-username Polymarket bot spam campaign.** A coordinated campaign is pushing Polymarket-branded bot repositories under accounts with randomised, garbled usernames — the classic pattern for laundering malicious repos past reputation filters. Do not clone anything from an account you cannot independently verify. Check commit history, check the account creation date, and check whether the stated strategy is coherent.

**2. Star farming on Telegram-Bot repository.** A repository advertising a Polymarket Telegram bot has been caught in a star-farming operation, artificially inflating its apparent legitimacy. Star count is not a trust signal. It has not been for some time. Treat it as negative signal when inflated this aggressively.

**3. 460KB exact-size clone fingerprint — known malware template.** This is the critical alert. A specific malware template previously documented in earlier campaigns produces a repository of almost exactly 460KB. Any repo you encounter matching that exact filesize — particularly one advertising Polymarket or prediction-market functionality — should be isolated and not executed. The template harvests wallet credentials and API keys. If you pulled anything matching this description in the last 72 hours, rotate your keys immediately and audit your positions for unauthorised transfers.

Total active security alerts today: **6**. Elevated. Do not onboard new tooling this week without extended due diligence.

---

Alpha Signals

Three research-layer signals surfaced today, none immediately actionable as live trades but directly relevant to strategy construction.

**Payoff-space vs. protocol-executable arbitrage.** A newly circulated paper draws a sharp distinction between arbitrage that exists in theory and arbitrage that can be captured before settlement given Polymarket's position transformation constraints. The practical implication: when you spot a negative-risk position in linked binary markets, model your exit path before entering. The friction is real and the window is often narrower than the spread suggests.

**Probabilistic consistency across condition-sharing markets.** Polymarket's condition-based structure means multiple markets inherit shared resolution logic. Deviations in implied probability across those linked markets are a documented arbitrage signal. If you are not already monitoring market clusters by shared condition ID, you are leaving edge on the table.

**Diffusion-based implied volatility forecasting.** A third paper presents a joint trajectory model for vol surfaces with no-arbitrage constraints baked into the autoencoder. Less immediately applicable to Polymarket's binary structure, but operators building pricing models for longer-dated markets should track this methodology.

---

Strategy Intelligence

The HN item on *Nothing Ever Happens* — a bot that mechanically buys No on all non-sports markets — reaching 471 points is worth more than a laugh. The strategy's performance record, however anecdotal, reflects genuine base-rate bias in how Polymarket questions are written. Most events don't happen. If you are building mean-reversion logic, this prior deserves a formal place in your calibration.

---

What to Watch

Spain's block will be tested by operators in the next two to three weeks — watch for workarounds, API availability signals, and whether Kalshi responds publicly. On the malware front, the 460KB fingerprint campaign suggests a coordinated actor, not a solo operator. A second wave of variants is likely. Keep your dependency trees shallow and your key rotation frequent.