it’s all usually part of a chain of uploads I think. Either Ryuu takes from here or here takes from ryuu. More commonly I think ryuu has it first most of the time. It’s particularly noticeable for the Mac users as if the Mac version is behind here: guaranteed it’s also behind at ryuu. Idk much about the scammer habits so I’ve got nothing else but to take your word for it.
1) it's up to your memory if you believe that my claim that this came out more or less a day later than ryuu (or try to get other testimonies i don't know ... btw european here so consider time zone too).
One thing that can help you out is that ryuu still has this game page link up and running (and they were untouched since they first put it on August 19 unless they really are the evil OG masterminds behind everything ...)
2)ryuu steal and gets stolen from yes ...
however the guys uploading stuff at ryuu are just a few (just 2 or 3 i'm assuming ...) and in "theory" they are supposed to be trusted ...
so even if they "steal" their stuff they would check it out first before uploading it themselves
so far i recall only one case of trojan by ryuu ...
What I'm getting at is that at ryuu things are more regulated than here
3)on f95 anyone can post a link and the thread owners or admin can naively put those links on the front page mistakinly trusting them to be safe.
This has happened MULTIPLE times here ...
4)now my speculation that i was try to imply was ...
scammer saw that on f95 it was behind in this flashy new hot release
took it (let's say from ryuu itself)
spend his one day window to put his trojan and upload it
put his link here
the rest is history ...