Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem
June 3, 2026 · Check Point Research · Severity: HIGH
Check Point Research uncovered a large-scale malware distribution operation that impersonates popular open-source and freeware projects, including trusted tools like Ghidra, dnSpy, and SpiderFoot. These deceptive sites mimic legitimate project portals, often referencing real resources, and trick users into downloading malicious software. When users click on download links, they are routed through a Traffic Distribution System (TDS) that filters traffic based on factors like geography and device type, ultimately redirecting them to malware delivery infrastructure. The campaign distributes multiple malware families, including RemusStealer, AnimateClipper, and the SessionGate framework, which delivers potentially unwanted applications (PUAs). The operation primarily targets security researchers and malware analysts by impersonating high-risk tools they rely on. The TDS enforces strict gating mechanisms, such as anti-bot logic and VPN filtering, to ensure only specific users are redirected. While the primary goal appears to be traffic acquisition and monetization, the integration of malware distribution poses significant security risks. VirusTotal telemetry indicates over 5,000 submissions related to this campaign, suggesting widespread exposure. This campaign highlights the evolving sophistication of cybercriminal tactics and the importance of verifying software sources before downloading.
Research by: Alexey Bukhteyev
Key Takeaways
- Check Point Research investigated a large-scale operation that impersonates open-source and freeware projects to capture search traffic, including lookalikes for researcher and security tooling such as Ghidra, dnSpy, and SpiderFoot. The sites are well-designed and often look like legitimate project portals at a glance, sometimes referencing real upstream resources. The deception is not in the page content alone, it’s in what happens when a user interacts.
- Our analysis shows these pages load a CloudFront-hosted JavaScript staging layer that converts a click on a “download” button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping.
- The observed ecosystem appears to be built primarily for traffic acquisition and monetization, likely leveraging legitimate ad-tech and monetization tooling, while downstream redirect chains repeatedly led selected users to malware delivery infrastructure.
- The downstream branches we analyzed led to multiple malware families, including RemusStealer, AnimateClipper, and the SessionGate framework, which we observed delivering PUA (Potentially Unwanted Applications), suggesting this was not an isolated malicious redirect.
Introduction
When we search Google for a popular piece of software, we usually click the first result, sometimes without even looking at the rest, because official project sites tend to rank highest and appear near the top of the results.
After landing on a site with a professional design and links that appear to point to the project’s official GitHub repository, most users intuitively trust it and proceed to download and run the installer without a second thought. Nothing seems suspicious: the first link in Google, a polished “official-looking” website, and references to the real project. What could go wrong?
Check Point Research investigated a large-scale campaign in which malicious and unwanted software is distributed through a gated traffic-routing stack. The operation relies on professionally built open-source and freeware impersonation sites, where click events initiate routing through a Traffic Distribution System (TDS) — a traffic-filtering and redirection layer that can send different users to different destinations based on factors such as geography, device type, browser fingerprint, or campaign rules — and can ultimately lead to payload delivery.
What makes this campaign especially notable is the choice of brands: a high-risk subset of sites impersonates trusted reverse-engineering tools such as Ghidra and dnSpy, used by security researchers and malware analysts.
The broader phenomenon of websites impersonating popular open-source and freeware projects had already been documented by late 2025. In November 2025, Fullstory reported a large cluster of such fraudulent domains and did not identify direct abuse in their examined samples at the time (including checking hosted archives against known-good content), while emphasizing the clear security risk and the potential for downstream phishing or watering-hole style abuse.
Our findings show that this ecosystem has evolved. We observed that by at least December 2025, the sites in this cluster had TDS scripts embedded into their workflow, and from early January 2026 onward, we recorded active malware distribution via the same infrastructure.
The scale is reflected in VirusTotal telemetry: more than 5,000 total submissions across relevant samples, indicating substantial reach in just the subset visible through public sharing. The real exposure is likely significantly higher.
Among the payloads distributed through this TDS infrastructure, we identified several malware families:
- SessionGate — A previously unknown multi-stage loader with heavy obfuscation and extensive anti-analysis mechanisms, which makes obtaining the final payload extremely difficult. In the chains we observed, it was used to deliver potentially unwanted applications (PUA). We examine SessionGate more deeply later on this article.
- RemusStealer — a newly emerged infostealer designed to steal data from more than 20 browsers and targeting hundreds of browser extensions and applications, including cryptocurrency wallets, two-factor authentication tools, and password managers.
- AnimateClipper — A cryptocurrency clipper capable of hijacking transactions across more than 20 blockchain ecosystems.
Importantly, we do not assess these impersonation sites as being built exclusively for malware distribution. The more plausible primary objective is traffic acquisition and monetization. However, by embedding a gated TDS layer and funneling search traffic into it, the operators become part of a distribution chain whose downstream consumers can include malware distributors. The same traffic pipeline that drives gray monetization can also selectively route real users to malicious payloads.
Impersonation, click hijacking, and the post-click routing
Our investigation started with several domains impersonating official project pages and download portals for tools widely used by security researchers.
For relevant queries, some of these “project portals” appeared surprisingly high in search results:
What these sites have in common is a shared staging component: their pages load CloudFront-hosted Traffic Distribution System scripts from Amazon CloudFront, a legitimate content delivery network (CDN) service widely used to distribute web content through globally distributed infrastructure. These scripts turn the first “Download” click into a post-click routing chain.
The scripts are fetched from URLs with a consistent pattern, for example:
https://d33f51dyacx7bd.cloudfront[.]net/?aydfd=1237183https://dcbbwymp1bhlf.cloudfront[.]net/?wbbcd=1236609
In total, we identified more than 100 currently active websites embedding these scripts, reusing the same campaign-style identifiers and the same CloudFront domains.
Below are some of the entry domains from the cluster, with an emphasis on impersonated brands that are commonly trusted by techn
Key Takeaways
- Check Point Research published an analysis of Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem providing threat intelligence on emerging attack techniques and campaigns.
- Organizations should review the full article for complete details and implement relevant security measures.
- Organizations should review the full article for complete details and implement relevant security measures.