Some screenshots of what the malware redirects looks like and their probably new-ish method which seems to get past through ublock, pop-up blocker and dns guard.

When you click on the download button in the file hosters, the first click will load these malware redirects.

They do it in three layers of links, example(xxx is to break the link but the generic form are like these):
[httpsx://link-file-d918t.buyqa2t.website/xxxxxxxxxxxxxxxxxxxxxxxxxxxxUJ0OEVtUDY6QzIifS4yZTU5ZGNjYw/0f2f6g](httpsx://link-file-xxxx.buyqa2t.website/xxxxxxxxxxxxxxxxxxxxxxxxxxxxUJ0OEVtUDY6QzIifS4yZTU5ZGNjYw/0f2f6g)

[httpsx://checking-id-xxxx.buyqa2t.website/?_802bef=8a61b568&data=eyJpZCxxxxxxxxxxxxxxxxxxxxxxxtUDY6QzIiLCJmaWxlIjpudWxsLCJyZWRpcmVjdFN0ZXAiOjAsInRpbWVzdGFtcCI6MTc4OTEzNDgwMX0%3D](httpsx://checking-id-xxxx.buyqa2t.website/?_802bef=8a61b568&data=eyJpZCxxxxxxxxxxxxxxxxxxxxxxxtUDY6QzIiLCJmaWxlIjpudWxsLCJyZWRpcmVjdFN0ZXAiOjAsInRpbWVzdGFtcCI6MTc4OTEzNDgwMX0%3D)

[httpsx://cloud-file-xxx.buyqa2t.website/](httpsx://cloud-file-xxxx.buyqa2t.webxsite/)

Before this they only have one link loaded, but now this new triple link load is new and seems to bypass even DNS filtering(at least to me).

The fake download pages will then show up, with variants looking like above, now having full screen form as well. Most of them seem to follow mediafire website design but some are slops design too. The brand names of the download page is not relevant and no affiliation to real ones if applicable. This design pattern will change, have a million variants but for now its easy to spot.

The malware files will not download unless you click on the download button and download it. It will also not run unless you yourself run the malicious exe/script. I assume it is still the same renpy malware files.

Any downloads as said on the file hosters page will download the file immediately at first click, no redirects, it all happens in the same window. Filecrypt multilink page seems to have no redirects issue, so they will always bring you to the right file hosters page first.

Be safe.