Threats · 102 days ago
The break is the selective gate. A site can look clean to one visitor and still hand malware to another, so a single check of the page or the download link can falsely clear it.
Check Point says this impersonation ecosystem now uses a traffic distribution system that decides who gets redirected based on geography, device type, browser fingerprint, and campaign rules. By early January 2026, the same infrastructure was being used for active malware delivery, with more than 5,000 VirusTotal submissions tied to the cluster.
That makes takedown and attribution harder than a normal fake-site campaign. The operator can keep the front end plausible, keep researchers on the benign path, and reserve the malicious path for targets who match the profile.
2 sources covering this story
Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS
A large-scale campaign impersonates open-source and freeware project portals to redirect users through a gated TDS and deliver malware.
Research by: Alexey Bukhteyev Key Takeaways Introduction When we search Google for a popular piece of software, we usually click the first result, sometimes without even looking at the rest, because official project sites tend to rank highest and appear near the top of the results.
Part of the PlainSec briefing for 2026-06-04