Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS

Cybersecurity researchers identified a large-scale operation impersonating open-source and freeware projects to deliver malware through a Traffic Distribution System (TDS). The sites load CloudFront-hosted JavaScript staging layer that converts download button clicks into handoffs to TDS with strict gating including first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping. The TDS redirect chains deliver malware on first access but benign software on repeated attempts from same IP. The operation includes multi-stage delivery with extensive validation logic and TDS-side gating designed to resist analysis. SessionGate acts as a multi-stage obfuscated loader with anti-analysis mechanisms. The final DLL payload communicates with external servers, retrieves encrypted configuration, extracts download URLs, and executes next-stage malware via cmd.exe.