Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS
Researchers found fake open-source tool sites ranking highly on Google and using a gated TDS chain to deliver malware or benign software depending on the visitor.
Intelligence analysis by GPT-5.4 Mini
Check Point says a large campaign uses polished lookalike pages for tools like Ghidra, dnSpy, and SpiderFoot to catch search traffic, then routes clicks through a Traffic Distribution System that can hand off select users to malware. The setup also shows anti-bot checks, benign fallback downloads, and traffic-gating designed to frustrate analysis.
Fake tool websites were built to look like real ones, like putting on a convincing costume. When people click download, the site can quietly send them down a maze that sometimes ends in malware instead of the real program.
Analysis
What happened
Check Point says a campaign is impersonating open-source and freeware project sites and using search-engine visibility to pull in people looking for legitimate tools. The fake pages are polished enough to pass a quick glance, sometimes even linking to real upstream resources, but the key abuse happens after a user clicks a download button.
How the chain works
According to the report, the pages load a CloudFront-hosted JavaScript layer that turns the first download click into a handoff to a Traffic Distribution System, or TDS. That TDS applies gating rules such as first-visit checks, click confirmation, anti-bot and anti-analysis logic, VPN and datacenter filtering, and frequency capping. In other words, not every visitor gets the same outcome.
The campaign appears to have started as traffic acquisition and monetization, but the infrastructure was later repurposed for malware delivery. Check Point says some redirect paths now lead to malware families including Remus Stealer, AnimateClipper, and SessionGate. Repeated visits from the same IP can even trigger benign software such as Opera or unnecessary browser extensions, which helps the site look harmless and complicates analysis.
Why the delivery is effective
One notable detail is that hovering over the download button can reveal the legitimate URL for the tool, which lends the page extra credibility. The operators also preserve real GitHub links and use click interception so the page feels authentic while quietly steering the first click into the gated TDS stack.
Payloads and impact
SessionGate is described as a multi-stage loader with strong anti-analysis behavior. Remus Stealer is framed as a new information stealer offered as malware-as-a-service, targeting browsers, extensions, wallets, 2FA tools, and password managers. AnimateClipper swaps clipboard crypto wallet addresses and can hijack transactions across many blockchain ecosystems.
Check Point says telemetry shows roughly 2,000 to 3,500 submissions tied to SessionGate so far, with samples coming from multiple countries. The main takeaway is that search ranking and legitimate-looking download flows can be abused as a malware distribution pipeline, even when the visible page seems normal at first glance.
Key points
- Fake sites impersonating open-source and freeware projects are ranking highly on Google and using a TDS to control who gets what after clicking download.
- Check Point says the pages mimic tools such as Ghidra, dnSpy, and SpiderFoot and use CloudFront-hosted JavaScript to intercept the first click.
- The infrastructure can serve benign software to repeat visitors or suspicious environments, while select users are redirected to malware.
- Reported payloads include SessionGate, Remus Stealer, and AnimateClipper, each aimed at stealing data or hijacking crypto activity.
- The campaign appears to have started as traffic monetization and later shifted into a malware distribution chain.
The report shows defenders can detect these campaigns by watching for fake portals, click interception, and suspicious redirect chains. Better browser and search protections could make it harder for lookalike sites to outrank the real projects and trap users before they download anything harmful.
If the sites keep ranking well, more people searching for trusted tools could be funneled into the same gated delivery system. The layered checks, benign fallback downloads, and per-client payload delivery also make the operation harder to analyze and disrupt quickly.
