diff --git a/modules/security/malware-scanner.sh b/modules/security/malware-scanner.sh
index d4f49de..f31431f 100755
--- a/modules/security/malware-scanner.sh
+++ b/modules/security/malware-scanner.sh
@@ -287,10 +287,10 @@ install_maldet_only() {
 
     # Download sources in priority order
     # Format: "name|url|label" (using | as delimiter to avoid splitting https://)
+    # Note: Repository is rfxn/linux-malware-detect (not maldet)
     local sources=(
-        "rfxn|https://www.rfxn.com/downloads/maldetect-latest.tar.gz|rfxn.com (official)"
-        "github-api|https://api.github.com/repos/rfxn/maldet/archive/refs/heads/main.tar.gz|GitHub API"
-        "github|https://github.com/rfxn/maldet/archive/refs/heads/main.tar.gz|GitHub direct"
+        "github-api|https://api.github.com/repos/rfxn/linux-malware-detect/tarball/1.6.6.1|GitHub Release 1.6.6.1"
+        "github-main|https://github.com/rfxn/linux-malware-detect/archive/refs/heads/main.tar.gz|GitHub main branch"
     )
 
     echo "Attempting to download from sources..."