As far as I've been able to figure out, he wrote an open source API hooking engine that was used as a key component of the Kronos malware. When he found his ho

As far as I've been able to figure out, he wrote an open source API hooking engine that was used as a key component of the Kronos malware. When he found his hooking code in a malware sample (presumably Kronos), he expressed his disappointment / frustration with this (ab)use of his work on twitter. Whether or not this is truthful or just public posturing remains to be seen. None of this is recent news - it played out in early 2016, so his arrest now is a little odd, unless the DOJ has uncovered new details that have not been publicly disclosed. If it turns out he is arrested for some of his public code in a piece of malware, it should worry both security researchers and open source developers a lot.