Check Point Research says a large malware operation is impersonating popular free developer tools and silently swapping their downloads for malware, even when the link on the page looks completely legitimate. In a June 3, 2026 report, researcher Alexey Bukhteyev describes more than 100 active fake sites and over 5,000 related sample submissions on VirusTotal, run like a commercial traffic-monetization business that funnels some visitors straight to infostealers and a cryptocurrency thief.
What's affected
The fake sites pose as well-known open-source and freeware tools, including the reverse-engineering utilities Ghidra, dnSpy, and ILSpy, plus grpcurl and mqttexplorer. Because several of these are tools used by malware analysts, security researchers themselves sit inside the likely victim pool, though Check Point found no evidence anyone was deliberately singled out. Submission activity was global, with concentrations in Turkey, Poland, Brazil, Germany, France, Russia, and the United Kingdom.
How the attack works
The trick is what the researchers call "click hijacking." The fake pages keep the real download link (the href) intact, often pointing at a genuine GitHub release, so the destination looks trustworthy if you inspect it. But a JavaScript file hosted on Amazon CloudFront intercepts the click, calls preventDefault() and stopImmediatePropagation() to cancel the real download, and hands the browser to the operators' own server instead. That server is a Traffic Distribution System (TDS), a gatekeeper that decides who gets what. It tracks first-time visitors, demands a confirmation click, filters out VPNs and datacenter IPs, and screens for bots and security sandboxes. Based on each visitor's location, device, and browser fingerprint, it routes them to a harmless offer, to unwanted "junkware," or to outright malware, which both maximizes profit and steers analysts away from the dangerous files.
Three malware families ride this pipeline. SessionGate is a previously unknown, heavily disguised multi-stage loader, seen mostly delivering unwanted applications, with individual samples drawing roughly 2,000 to 3,500 VirusTotal submissions. RemusStealer is an infostealer built to raid more than 20 browsers and hundreds of browser extensions. AnimateClipper is a crypto clipper that can quietly rewrite cryptocurrency transactions across more than 20 blockchain ecosystems. The same "trust the trusted source" pattern powers other 2026 campaigns IntelFusions has tracked, from ClickFix delivery via compromised legitimate sites to malvertising through Google-verified ads.
What you should do
Download developer tools only from official project pages and trusted package managers, not from search results or ads. Block the listed domains, hunt for the CloudFront staging-script pattern on download pages, and treat lookalike domains for reverse-engineering tools as high risk on analyst machines. The old advice to "just verify the download link" no longer holds here, because the link can be authentic while the click is silently redirected.
A defanged selection of indicators from Check Point's reporting (re-arm only in controlled environments): fake sites ghidralite[.]com, dnspy[.]org, and ilspy[.]org; SessionGate command-and-control at appfreshstart[.]com, appgetonline[.]com, and appmakingcenter[.]com; RemusStealer C2 at buccstanor[.]pics:28313 and baxe[.]pics:48261; AnimateClipper C2 at kr.hugo-lapp[.]co. File hashes (SHA-256) include SessionGate stage 1 598b023e56c45b19173e8f96c1c88036d732fec305cf6bf1b9cf4dbe304beb7f and 74091f5a8746a1c68d73e1fc1e4e1ff514632ee3f632a8b306f35dabae2d2b64, RemusStealer 39dc2327fe1e5a56ac5ad9dc02f0386cff3d83dcfdc558cacba42ebb9dcc5ec2, and AnimateClipper e6a1a428a7c09c9946f7c0179d89b263f442dc3208b5144a9146c200e4185bd6.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.