8 minhigh
Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem
Check Point Research uncovered a large-scale malware distribution ecosystem that uses search engine optimization and impersonated open-source project sites to drive traffic to a sophisticated Traffic Distribution System (TDS). The TDS employs click hijacking and strict gating to selectively deliver malware, including the SessionGate loader, RemusStealer, and AnimateClipper, while actively evading automated analysis through one-time key releases and file inflation.
Conf:highAnalyzed:2026-06-03Google
Showing defanged values
- domainappfreshstart[.]comSessionGate Stage 1 C2 server
- domainappgetonline[.]comSessionGate C2 server
- domainappmakingcenter[.]comSessionGate C2 server
- domainarch2[.]maxdatahost1[.]cyouTDS download gate domain
- domaincarlessclapped[.]comAnimateClipper C2 server
- domaincrystaldiskmark[.]orgImpersonated CrystalDiskMark project website
- domaincw[.]hugo-lapp[.]latAnimateClipper C2 server
- domaindnspy[.]orgImpersonated dnSpy project website
- domained[.]hugo-lapp[.]latAnimateClipper C2 server
- domainfd[.]hugo-lapp[.]latAnimateClipper C2 server
- domainfile-enter-web[.]comTDS anti-bot gate domain
- domainflame-guard[.]ccAnimateClipper C2 server
- domaingetfluxfile[.]comSessionGate landing page
- domainghidralite[.]comImpersonated Ghidra project website
- domaingrpcurl[.]comImpersonated gRPCurl project website
- domainguiformat[.]comImpersonated GUIFormat project website
- domainilspy[.]orgImpersonated ILSpy project website
- domainintegritycrc[.]comSessionGate CRC key broker C2 server
- domainio[.]hugo-lapp[.]latAnimateClipper C2 server
- domainjavascriptapiusa[.]comSessionGate server-side validation API
- domainkr[.]hugo-lapp[.]coAnimateClipper C2 server resolved via smart contract
- domainmedia[.]stellarcloudhub1[.]cfdTDS download gate domain
- domainmfcmapi[.]comImpersonated MFCMAPI project website
- domainmobileversioncrc[.]comSessionGate CRC key broker C2 server
- domainmqttexplorer[.]comImpersonated MQTT Explorer project website
- domainoriginaldownloads[.]infoSessionGate landing page
- domainoundhertobeconsist[.]orgTDS post-click redirector domain
- domainprocessing-in-progress-x4[.]t3[.]storage[.]devClickFix phishing page domain used to deliver AnimateClipper
- domainst[.]hugo-lapp[.]latAnimateClipper C2 server
- domaintd[.]hugo-lapp[.]latAnimateClipper C2 server
- domaintrkscope[.]xyzTDS multi-gate redirector domain
- domainukentaspectsofc[.]orgTDS pixel/tracking domain
- domainwebcrcprove[.]comSessionGate CRC key broker C2 server
- domainwebinnosetup[.]comSessionGate C2 server
- domainwinsetupfromusb[.]orgImpersonated WinSetupFromUSB project website
- domainyourfastcrc[.]comSessionGate CRC key broker C2 server
- sha25615e6df0c95f2147952308e640d55270e9d097639eaebb34d4b352415f1c6bcebSessionGate Stage 1
- sha25626f2abfc254a59c2386dd46dca16744f7147a0f0366cb6008e1d53219175f44cSessionGate Stage 2 DLL #2
- sha256
- sha25639dc2327fe1e5a56ac5ad9dc02f0386cff3d83dcfdc558cacba42ebb9dcc5ec2RemusStealer payload executable
- sha2563bb92771e287aa0a8bdd8e5b5bb697427223eaefded3d9b64b5d5c32ad40f3c2SessionGate Stage 1
- sha2564cdb1f7ac502289119f7f8256f00baaa994e6ecfb4000dcf5e1c46073508fcb3SessionGate Stage 2
- sha256598b023e56c45b19173e8f96c1c88036d732fec305cf6bf1b9cf4dbe304beb7fSessionGate Stage 1 loader executable
- sha25674091f5a8746a1c68d73e1fc1e4e1ff514632ee3f632a8b306f35dabae2d2b64SessionGate Stage 1
- sha256
- sha256cbad672d9bd06ce91ce465d049e50696fbaec9d209ca0ab1fd814d993d04bc9bSessionGate Stage 1 and Stage 2 DLL #1
- sha256ce0888df5e28716432013a8ae002437bd3e993fbe8362c5ff9efbddabfe0ab77SessionGate Stage 2 DLL #1
- sha256e6a1a428a7c09c9946f7c0179d89b263f442dc3208b5144a9146c200e4185bd6AnimateClipper payload executable
- urlhxxp://194[.]150[.]220[.]218/4SLEYpfAk57hGubo/fo0suc2ki2[.]rtfAnimateClipper PowerShell stage URL
- urlhxxp://217[.]156[.]122[.]75:1378RemusStealer C2 endpoint
- urlhxxp://94[.]231[.]205[.]229:28313RemusStealer C2 endpoint
- urlhxxp://baxe[.]pics:48261RemusStealer C2 server endpoint
- urlhxxp://buccstanor[.]pics:28313RemusStealer C2 endpoint
- urlhxxp://buccstanor[.]pics:48261RemusStealer C2 endpoint
- urlhxxp://forestoaker[.]com:6290RemusStealer C2 endpoint
- urlhxxp://gluckcreek[.]online:48261RemusStealer C2 endpoint
- urlhxxp://intem[.]lat:9592RemusStealer C2 endpoint
- urlhxxp://ropea[.]top:28313RemusStealer C2 endpoint
- urlhxxps://cdn-1415[.]brightcanvas[.]digital/fo0suc2ki2[.]rtfAnimateClipper payload download URL
- urlhxxps://d33f51dyacx7bd[.]cloudfront[.]net/?aydfd=1237183CloudFront-hosted TDS staging script
- urlhxxps://dcbbwymp1bhlf[.]cloudfront[.]net/?wbbcd=1236609CloudFront-hosted TDS staging script
- urlhxxps://s3[.]us-east-2[.]amazonaws[.]com/marketstagofortdas/ehjm145uvt/Download_Ready_461049[.]exeSessionGate payload download URL
Detection / HunterGoogle
What Happened
Attackers are creating fake websites that look exactly like official pages for popular free software tools. When a user clicks the download button, hidden scripts hijack the click and redirect them through a filtering system that checks if they are a real target. If the user passes the checks, they are tricked into downloading malicious programs that can steal passwords, hijack cryptocurrency transactions, or install unwanted software. This matters because even careful users searching for legitimate tools can be compromised. To stay safe, users should always verify they are downloading software from the official source, such as the actual GitHub repository, and organizations should monitor for unexpected network redirects during software downloads.
Key Takeaways
- A large-scale operation is impersonating open-source and freeware projects (e.g., Ghidra, dnSpy) to capture search traffic and distribute malware.
- The campaign uses CloudFront-hosted JavaScript to hijack download clicks and route users through a Traffic Distribution System (TDS).
- The TDS enforces strict gating, including anti-bot checks, VPN filtering, and frequency capping, to selectively deliver payloads.
- Delivered malware includes the SessionGate multi-stage loader, RemusStealer (an infostealer targeting browsers and crypto wallets), and AnimateClipper.
- SessionGate employs heavy obfuscation, server-side registration, and one-time key release to severely hinder automated and manual analysis.
Affected Systems
- Windows
- Chromium-based browsers
- Firefox
- Cryptocurrency wallets
- Password managers
Attack Chain
The attack begins when a user visits a fake open-source project website and clicks a download link. A CloudFront-hosted JavaScript intercepts the click and redirects the user through a Traffic Distribution System (TDS) that performs environment and bot checks. Depending on the user's profile, the TDS delivers various payloads, such as the SessionGate loader, which uses one-time keys and heavy obfuscation to drop unwanted applications. Alternatively, users may receive RemusStealer to exfiltrate browser and crypto wallet data, or be directed to a ClickFix phishing page that uses mshta.exe to execute AnimateClipper, a clipboard-hijacking cryptocurrency stealer.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules (YARA, Sigma, etc.), but outlines behavioral indicators and infrastructure patterns for hunting.
Detection Engineering Assessment
EDR Visibility: High — EDRs can detect mshta.exe making external network connections, manual PE mapping in memory, and suspicious child processes spawned from browsers or temporary directories. Network Visibility: Medium — While C2 traffic is encrypted (HTTPS) or uses custom protocols, the initial TDS redirects, mshta.exe downloads, and smart contract RPC queries (Binance Smart Chain) can be monitored. Detection Difficulty: Moderate — The heavy use of obfuscation, one-time keys, and legitimate CDN infrastructure (CloudFront) makes static analysis and network blocking difficult, but the behavioral execution chain (e.g., mshta.exe) is highly anomalous.
Required Log Sources
- Process Creation (Event ID 4688 / Sysmon Event ID 1)
- Network Connections (Sysmon Event ID 3)
- DNS Queries (Sysmon Event ID 22)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for mshta.exe executing with command-line arguments containing external URLs, especially those pointing to unusual extensions like .7z or .rtf. | Process Creation | Execution | Low |
| If you have visibility into network traffic, consider hunting for endpoints querying public Binance Smart Chain RPC nodes (e.g., data-seed-prebsc-1-s1.binance.org) which may indicate smart contract C2 resolution. | Network Connections / DNS | Command and Control | Low |
| Consider hunting for large executable files (e.g., >800MB) being downloaded and executed from temporary directories, which may indicate artificial file inflation for evasion. | File Creation / Process Creation | Defense Evasion | Medium |
Control Gaps
- Automated sandbox analysis (due to file inflation and one-time key gating)
- Static AV scanning (due to heavy obfuscation and manual PE mapping)
Key Behavioral Indicators
- mshta.exe making external HTTP requests
- Executables with massive zero-filled padding (inflation)
- Processes querying DPAPI (CryptUnprotectData) and accessing multiple browser extension directories
False Positive Assessment
- Low
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting.
- Consider blocking the identified C2 domains and IP addresses at the network perimeter.
- Evaluate whether to block or restrict the execution of mshta.exe if it is not required for business operations.
Infrastructure Hardening
- Consider implementing DNS filtering to block known malicious TDS redirectors and newly registered domains.
- If applicable, restrict outbound network access from endpoints to public cryptocurrency RPC nodes.
User Protection
- Consider deploying browser extensions or endpoint controls that warn users when visiting newly observed or low-reputation domains.
- Evaluate enforcing application control policies to prevent the execution of unsigned binaries downloaded from the internet.
Security Awareness
- Consider training developers and engineers to verify software downloads by checking digital signatures and using official package managers or repositories.
- Evaluate incorporating examples of 'ClickFix' fake verification screens into security awareness training.
MITRE ATT&CK Mapping
- T1036.005 - Masquerading: Match Legitimate Name or Location
- T1059.005 - Command and Scripting Interpreter: Visual Basic
- T1059.001 - Command and Scripting Interpreter: PowerShell
- T1218.005 - System Binary Proxy Execution: Mshta
- T1027.002 - Obfuscated Files or Information: Software Packing
- T1055.001 - Process Injection: Dynamic-link Library Injection
- T1555.003 - Credentials from Password Stores: Credentials from Web Browsers
- T1115 - Clipboard Data
- T1566.002 - Phishing: Spearphishing Link
Additional IOCs
- Domains:
ghidralite[[.]]com- Impersonated Ghidra project websitednspy[[.]]org- Impersonated dnSpy project websiteilspy[[.]]org- Impersonated ILSpy project websitegrpcurl[[.]]com- Impersonated gRPCurl project websitemqttexplorer[[.]]com- Impersonated MQTT Explorer project websitemfcmapi[[.]]com- Impersonated MFCMAPI project websitewinsetupfromusb[[.]]org- Impersonated WinSetupFromUSB project websitecrystaldiskmark[[.]]org- Impersonated CrystalDiskMark project websiteguiformat[[.]]com- Impersonated GUIFormat project websiteoundhertobeconsist[[.]]org- TDS post-click redirector domainukentaspectsofc[[.]]org- TDS pixel/tracking domaintrkscope[[.]]xyz- TDS multi-gate redirector domainfile-enter-web[[.]]com- TDS anti-bot gate domainmedia[.]stellarcloudhub1[[.]]cfd- TDS download gate domainarch2[.]maxdatahost1[[.]]cyou- TDS download gate domainoriginaldownloads[[.]]info- SessionGate landing pagegetfluxfile[[.]]com- SessionGate landing pagejavascriptapiusa[[.]]com- SessionGate server-side validation APIappgetonline[[.]]com- SessionGate C2 serverwebinnosetup[[.]]com- SessionGate C2 serverappmakingcenter[[.]]com- SessionGate C2 serveryourfastcrc[[.]]com- SessionGate CRC key broker C2 servermobileversioncrc[[.]]com- SessionGate CRC key broker C2 serverintegritycrc[[.]]com- SessionGate CRC key broker C2 serverio[.]hugo-lapp[[.]]lat- AnimateClipper C2 servercw[.]hugo-lapp[[.]]lat- AnimateClipper C2 serverst[.]hugo-lapp[[.]]lat- AnimateClipper C2 servertd[.]hugo-lapp[[.]]lat- AnimateClipper C2 serverfd[.]hugo-lapp[[.]]lat- AnimateClipper C2 servered[.]hugo-lapp[[.]]lat- AnimateClipper C2 serverflame-guard[[.]]cc- AnimateClipper C2 servercarlessclapped[[.]]com- AnimateClipper C2 server
- Urls:
hxxps://d33f51dyacx7bd[.]cloudfront[.]net/?aydfd=1237183- CloudFront-hosted TDS staging scripthxxps://dcbbwymp1bhlf[.]cloudfront[.]net/?wbbcd=1236609- CloudFront-hosted TDS staging scripthxxps://s3[.]us-east-2[.]amazonaws[.]com/marketstagofortdas/ehjm145uvt/Download_Ready_461049.exe- SessionGate payload download URLhxxp://buccstanor[.]pics:28313- RemusStealer C2 endpointhxxp://217[.]156[.]122[.]75:1378- RemusStealer C2 endpointhxxp://intem[.]lat:9592- RemusStealer C2 endpointhxxp://ropea[.]top:28313- RemusStealer C2 endpointhxxp://forestoaker[.]com:6290- RemusStealer C2 endpointhxxp://buccstanor[.]pics:48261- RemusStealer C2 endpointhxxp://94[.]231[.]205[.]229:28313- RemusStealer C2 endpointhxxp://gluckcreek[.]online:48261- RemusStealer C2 endpointhxxps://cdn-1415[.]brightcanvas[.]digital/fo0suc2ki2.rtf- AnimateClipper payload download URL
- File Hashes:
74091f5a8746a1c68d73e1fc1e4e1ff514632ee3f632a8b306f35dabae2d2b64(SHA256) - SessionGate Stage 115e6df0c95f2147952308e640d55270e9d097639eaebb34d4b352415f1c6bceb(SHA256) - SessionGate Stage 13bb92771e287aa0a8bdd8e5b5bb697427223eaefded3d9b64b5d5c32ad40f3c2(SHA256) - SessionGate Stage 1cbad672d9bd06ce91ce465d049e50696fbaec9d209ca0ab1fd814d993d04bc9b(SHA256) - SessionGate Stage 1 and Stage 2 DLL #14cdb1f7ac502289119f7f8256f00baaa994e6ecfb4000dcf5e1c46073508fcb3(SHA256) - SessionGate Stage 2ce0888df5e28716432013a8ae002437bd3e993fbe8362c5ff9efbddabfe0ab77(SHA256) - SessionGate Stage 2 DLL #126f2abfc254a59c2386dd46dca16744f7147a0f0366cb6008e1d53219175f44c(SHA256) - SessionGate Stage 2 DLL #287361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886(SHA256) - AnimateClipper2e842eab0c16ddd1a2ec4a56610adb58d115b65a1e08e9b67e7e375f8eed0873(SHA256) - RemusStealer
- File Paths:
D:\code\cpp-downloader-scb-reg-other\Plugins\7ZipDownloader\Output\SFXWin.pdb- PDB path found in SessionGate Stage 2 binary
- Command Lines:
- Purpose: Executes a remote HTA payload using the built-in mshta utility as part of the ClickFix infection chain. | Tools:
mshta.exe| Stage: Execution |mshta.exe https://
- Purpose: Executes a remote HTA payload using the built-in mshta utility as part of the ClickFix infection chain. | Tools:
