Cybercriminals Deploy Fake Open-Source Tool Sites to Distribute SessionGate and RemusStealer

Cybercriminals have launched a large-scale campaign creating professional fake websites that impersonate trusted open-source security tools including Ghidra, dnSpy, and SpiderFoot. When users click download links that appear to point to official GitHub repositories, hidden scripts hijack the request and route it through a Traffic Distribution System that filters victims by geolocation, browser, and IP history. Those who pass the stealth checks are served severe malware families like SessionGate and RemusStealer, which steal credentials, crypto wallets, and two-factor authentication tokens, while bots and analysts may receive benign decoy files. The dynamic gating and use of legitimate CDNs make the campaign exceptionally difficult to detect and track.