diff --git a/modules/security/malware-scanner.sh b/modules/security/malware-scanner.sh
index f31431f..c137d52 100755
--- a/modules/security/malware-scanner.sh
+++ b/modules/security/malware-scanner.sh
@@ -425,21 +425,32 @@ install_maldet_only() {
         echo "  Extracting archive..."
         if tar xzf "$temp_file" 2>/dev/null; then
             echo "  Running installer..."
-            if cd maldetect-* 2>/dev/null && bash install.sh > /tmp/maldet-install.log 2>&1; then
-                echo -e "  ${GREEN}✓ Maldet installed successfully${NC}"
+            # Find the extracted directory (could be maldetect-* or rfxn-linux-malware-detect-*)
+            local install_dir
+            install_dir=$(find . -maxdepth 1 -type d \( -name "*malware*" -o -name "*maldet*" \) 2>/dev/null | head -1)
 
-                # Update signatures in background
-                echo ""
-                echo "Updating malware signatures..."
-                if command -v maldet &>/dev/null; then
-                    maldet -u > /dev/null 2>&1 &
-                    echo "  (signatures updating in background)"
+            if [ -n "$install_dir" ] && [ -f "$install_dir/install.sh" ]; then
+                if cd "$install_dir" 2>/dev/null && bash install.sh > /tmp/maldet-install.log 2>&1; then
+                    echo -e "  ${GREEN}✓ Maldet installed successfully${NC}"
+
+                    # Update signatures in background
+                    echo ""
+                    echo "Updating malware signatures..."
+                    if command -v maldet &>/dev/null; then
+                        maldet -u > /dev/null 2>&1 &
+                        echo "  (signatures updating in background)"
+                    fi
+                else
+                    echo -e "  ${RED}✗ Installation failed. Check /tmp/maldet-install.log${NC}"
                 fi
             else
-                echo -e "  ${RED}✗ Installation failed. Check /tmp/maldet-install.log${NC}"
+                echo -e "  ${RED}✗ Could not find install.sh in extracted directory${NC}"
+                if [ -z "$install_dir" ]; then
+                    echo "  (Directory not found matching *malware* or *maldet*)"
+                fi
             fi
             cd /tmp
-            rm -rf maldetect-* maldetect-latest.tar.gz 2>/dev/null || true
+            rm -rf maldetect-* rfxn-linux-malware-detect-* maldetect-latest.tar.gz 2>/dev/null || true
         else
             echo -e "  ${RED}✗ Failed to extract archive${NC}"
             rm -f "$temp_file"