Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS
Summary: Check Point researcher Alexey Bukhteyev documented a large-scale operation that impersonates open-source and freeware project portals, including Ghidra, dnSpy, and SpiderFoot, and ranks them above the real projects in Google search results. Clicking a download button routes users through a CloudFront-hosted JavaScript staging layer into a Traffic Distribution System with first-visit gating, anti-bot logic, VPN filtering, and frequency capping, delivering Remus Stealer, AnimateClipper, and the SessionGate framework, with VirusTotal showing roughly 2,000 to 3,500 SessionGate sample submissions mostly from Turkey, Poland, Brazil, Germany, France, Russia, and the U.K.
Bottom line: The redirect chains are built so repeat visits from the same IP address return benign software like the Opera browser, meaning your analysts testing a suspicious download link may never see the payload their users would receive.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026