460KB Malware Template Resurfaces Across Polymarket and Kalshi

460KB Malware Campaign Expands to Kalshi — Same Template, New Lure

The most pressing story today is not a new threat, but a persistent one getting worse. The 460KB exact-size malware template previously flagged in Polymarket bot repositories has now been confirmed reused in a Kalshi-branded clone (`Kalshi-trade-bot`). This is a campaign, not a coincidence. Whoever is maintaining this payload is actively rotating target audiences as prediction market interest broadens beyond Polymarket. If you have cloned any bot repository in the last 30 days advertising Polymarket or Kalshi automation, audit it now — specifically check for executables or encoded blobs near 460KB.

Zero new legitimate repositories were found today worth flagging for review. The signal-to-noise ratio in public prediction market repos remains poor.

---

Security Alerts (8 Active)

**Critical — Malware Campaign (2 alerts):** - `460KB exact-size Polymarket/Kalshi bot malware template clone` — same binary payload, Polymarket branding. Do not run. - `Same 460KB clone template re-used for Kalshi-trade-bot` — Kalshi branding applied to identical template. Confirmed campaign behavior.

**Star Farming (1 alert):** - `polymarket-tennis` is showing clear star-farming signatures: 317 stars against 276 forks is an abnormal ratio for a niche sports-market bot. Treat any strategy or code from this repo as unverified. High fork counts relative to organic discovery patterns suggest coordinated inflation.

Remaining 5 alerts are in the full tier. Broad pattern today: attackers are following platform diversity. As Kalshi gains mindshare, expect the same lure-and-payload kits to follow.

---

Alpha Signals

Three research-layer signals worth building around this week:

**1. Payoff-Space vs. Protocol-Executable Arbitrage (Research Paper)** This is the most technically significant paper flagged in recent months. It draws a hard line between arbitrage that exists mathematically in payoff space and arbitrage that is actually executable given the position transformations Polymarket's protocol supports. The negative-risk (mutually exclusive linked binary) market structure is the central case study. Practical implication: if you are running arb logic against linked binary markets and not accounting for what the protocol will actually let you do with positions, your backtests are lying to you. Read this before touching negative-risk markets programmatically.

**2. Condition-Set Violations Across Linked Markets (Research Paper)** A complementary paper studying Polymarket directly, focused on markets where resolution conditions fail to be exhaustive or mutually exclusive in practice. It catalogs the arbitrage structures that appear when linked markets are priced inconsistently against their stated condition sets. This is a live edge: condition-set slippage is not rare on Polymarket, particularly on geopolitical and electoral markets with complex resolution criteria. Worth building a scanner against active linked markets.

**3. LLM Merger-Arb Forecasting via Long-Context Engineering (Strategy Signal)** A system using expert-guided context engineering plus finetuning to process hundreds of pages of M&A documents for resolution forecasting outperforms generic LLM approaches on specialized events. For operators building forecasting pipelines around high-stakes single-resolution markets (mergers, regulatory decisions, court rulings), the core finding is that domain-specific context framing matters more than model size. Finetuning on resolution-relevant document types is the lever.

---

Strategy Intelligence

The HN item on "Nothing Ever Happens" — a bot that always buys No on non-sports markets — getting 471 points is a signal in itself. Retail attention is on simple, legible strategies. That increases the likelihood of No-side mispricing being competed away on high-visibility markets while lower-visibility markets remain softer.

Spain blocking Polymarket and Kalshi over gambling licensing is a regulatory precedent to watch. EU operator exposure is real.

---

What to Watch

• Monitor for a third variant of the 460KB template appearing under new platform branding (Metaculus, Manifold, or a generic "prediction market bot" lure are the likely next targets).
• Track the linked binary market condition-set scanner opportunity — no known public implementation exists yet.
• Iran missile market death threats reaching 1,606 HN points means mainstream scrutiny of Polymarket's moderation and resolution practices is intensifying. Resolution disputes on high-liquidity geopolitical markets may become less predictable in the near term.