Fake Software Sites Now Filter Who Sees the Malware
The break is the selective gate. A site can look clean to one visitor and still hand malware to another, so a single check of the page or the download link can falsely clear it.
Check Point says this impersonation ecosystem now uses a traffic distribution system that decides who gets redirected based on geography, device type, browser fingerprint, and campaign rules. By early January 2026, the same infrastructure was being used for active malware delivery, with more than 5,000 VirusTotal submissions tied to the cluster.
That makes takedown and attribution harder than a normal fake-site campaign. The operator can keep the front end plausible, keep researchers on the benign path, and reserve the malicious path for targets who match the profile.