Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS

Cybersecurity researchers uncovered a large-scale operation that uses fake sites mimicking open-source tools to distribute malware through a Traffic Distribution System.

• •Attackers created fake portals imitating trusted tools like Ghidra, dnSpy, and SpiderFoot to target security-conscious users searching on Google
• •A CloudFront-hosted JavaScript layer converts download clicks into TDS redirects with strict gating including anti-bot logic and VPN filtering
• •Malware families deployed include SessionGate (multi-stage obfuscated loader), Remus Stealer (information stealer targeting 20+ browsers), and AnimateClipper (cryptocurrency clipper)
• •The fake sites rank highly in Google search results, often appearing above legitimate project websites, maximizing visibility and user traffic
• •