Fake Ghidra, dnSpy, SpiderFoot Sites Spread Malware

Key Takeaways

• Cybercriminals are operating a sophisticated campaign using over 100 fake websites that impersonate popular security tools like Ghidra, dnSpy, and SpiderFoot.
• These deceptive sites employ a Traffic Distribution System (TDS) to filter users and deliver various malware payloads, including the data-stealing RemusStealer, the cryptocurrency-hijacking AnimateClipper, and the highly obfuscated loader SessionGate.
• The campaign, active since December 2025, specifically targets security professionals, making it particularly dangerous due to the trust placed in these tools and the advanced evasion techniques used.
• No direct fix is available for the fake websites themselves; vigilance and adherence to secure download practices are crucial for prevention.

Sophisticated Fake Websites Target Security Professionals with Advanced Malware

Threat actors are deploying highly convincing fake websites designed to mimic legitimate project pages for widely used security tools. These deceptive sites are part of a large-scale operation aimed at tricking users, particularly cybersecurity professionals, into downloading malicious software instead of the intended applications. The campaign leverages sophisticated techniques, including a Traffic Distribution System (TDS) and advanced malware payloads, to evade detection and compromise victims.

Impersonation and Evasion Tactics

The fake websites are meticulously crafted to appear almost identical to their genuine counterparts, featuring professional designs and even linking to actual GitHub repositories. This high level of fidelity makes them difficult to distinguish from legitimate sources, even for vigilant users. Researchers at Check Point Research, who investigated this campaign, noted that more than 100 active fake sites have been identified, all sharing common CloudFront-hosted scripts and campaign identifiers. Examples include domains like ghidralite[.]com and dnspy[.]org, which often appear high in search engine results, lending them an undeserved air of authenticity.

When a user attempts to download software from these imposter sites, a hidden mechanism is triggered. Instead of directly receiving the desired program, the user’s request is silently intercepted by a JavaScript script hosted on Amazon’s CloudFront network. This script then routes the user through a Traffic Distribution System (TDS). The TDS acts as a gatekeeper, analyzing various parameters such as the user’s geographic location, browser type, VPN usage, and whether a security researcher might be present. Based on this analysis, the TDS decides whether to deliver a benign file or redirect the user to a malicious payload, making the entire operation highly evasive and difficult to trace. The process is seamless, with no visible indication to the user that anything unusual has occurred. Even hovering over a download button might display a legitimate GitHub URL, further deceiving cautious individuals.

Malware Payloads and Their Capabilities

The campaign delivers three distinct malware families as final payloads, each with specific, dangerous capabilities:

• RemusStealer: This newly identified information stealer targets sensitive data from over 20 different browsers. Its focus includes cryptocurrency wallets, password managers, and two-factor authentication tools, posing a significant risk of financial and identity theft.
• AnimateClipper: This malware specializes in silently monitoring the victim’s clipboard. When a cryptocurrency wallet address is copied, AnimateClipper intercepts it and replaces it with an attacker-controlled address, diverting funds during transactions without the victim’s knowledge.
• SessionGate: Described as a multi-stage loader, SessionGate is notable for its aggressive obfuscation and unique one-time-key delivery mechanism. These features make it exceptionally challenging for security analysts to examine and reverse-engineer, hindering defensive efforts.

The operation has been active since at least December 2025, with confirmed malware delivery beginning in early January 2026. VirusTotal telemetry indicates over 5,000 submissions related to samples from this campaign, though researchers believe the actual exposure is considerably higher. The deliberate targeting of tools frequently used by security researchers underscores the campaign’s alarming nature, as it aims to compromise individuals specifically trained to detect such threats.

SessionGate: An Analyst’s Nightmare

Among the discovered payloads, SessionGate stands out due to its advanced anti-analysis capabilities. The initial downloaded file is a 7-Zip archive, approximately 20 MB in size. However, the actual executable within is only 15 MB; the remaining 5 MB consists of heavily obfuscated loader code specifically designed to disrupt decompilers like IDA. Functions within SessionGate can exceed 500 KB, and encrypted strings are strategically embedded within code regions to further confuse disassemblers.

Adding to the complexity, the decryption key for SessionGate’s final payload stage is generated server-side and is unique to each victim’s session. If a researcher attempts to replay the infection chain from a different IP address, the server will return a valid-looking but ultimately useless key, rendering the payload unreadable and effectively thwarting analysis efforts.

What You Should Do

Given the sophisticated nature of this campaign and its targeting of security professionals, robust mitigation strategies are essential:

• Download from Official Sources Only: Always download software exclusively from the official project website or verified, trusted repositories. Avoid third-party download sites, even if they appear legitimate.
• Verify File Hashes: After downloading any software, verify its cryptographic hash (e.g., SHA-256) against the hash provided on the official developer’s website. This ensures the integrity and authenticity of the downloaded file.
• Monitor Outbound Connections: Implement network monitoring to detect and block outbound connections to known Command and Control (C2) domains and infrastructure associated with this campaign. Refer to the Indicators of Compromise (IoCs) below for specific details.
• Educate Users: Regularly remind all users, especially those in security roles, about the risks of supply chain attacks and sophisticated phishing tactics like website impersonation.

Indicators of Compromise (IoCs)

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.