Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS

Swati KhandelwalJun 04, 2026Malware / Open Source

Cybersecurity researchers have flagged a large-scale operation that impersonates open-source and freeware projects to funnel unsuspecting users through a Traffic Distribution System (TDS) and deliver malware families like Remus Stealer, AnimateClipper, and the SessionGate framework.

“The sites are well-designed and often look like legitimate project portals at a glance, sometimes referencing real upstream resources,” Check Point security researcher Alexey Bukhteyev said in a breakdown of the campaign. “The deception is not in the page content alone, it’s in what happens when a user interacts.”

“These pages load a CloudFront-hosted JavaScript staging layer that converts a click on a ‘download’ button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping.”

It’s suspected that the operation is designed for traffic acquisition and monetization, while leading select users to malware delivery infrastructure. Some of the identified sites mimic trusted reverse-engineering and security tooling such as Ghidra, dnSpy, and SpiderFoot.

Attack chains specifically target users looking for such tools on search engines like Google, causing the bogus sites to be surfaced on top of the search results. An early iteration of the campaign was documented by Fullstory in November 2025. Evidence indicates that the activity has been ongoing since September 2025.

“These domains are focused on gaining favorable search engine rankings by leveraging the name, brand, and popularity of the original web sites and projects,” the Atlanta-based company noted at the time. “Many sites are in the top rankings on Google for the relevant search term, often eclipsing the real project’s web site. This makes their visibility an asset and can maximize links and content.”

Although…

Source