Fake Open-Source Tools Deliver Malware via Google SEO Poisoning and TDS

A sophisticated and large-scale malware campaign is actively exploiting the trust developers place in open-source software. By creating highly convincing fake websites for popular tools and manipulating Google search rankings through SEO poisoning, threat actors are delivering a diverse arsenal of malware via Traffic Distribution Systems (TDS). This operation, active since at least September 2025 with intensified activity in early 2026, represents a significant evolution in supply chain-style attacks targeting the developer community.

The Attack Vector: SEO Poisoning and Impersonation

The campaign operates by cloning legitimate open-source project websites, including well-known security and reverse-engineering tools such as Ghidra, dnSpy, and SpiderFoot. These fraudulent sites are meticulously crafted to appear authentic, often referencing real GitHub repositories, documentation, and upstream resources to bypass initial scrutiny.

To ensure victims land on these malicious mirrors, attackers employ SEO (Search Engine Optimization) poisoning techniques:

• Paid Advertisements: Purchasing Google Ads to place fake download links at the very top of search results.
• Ranking Manipulation: Using bot networks and link farms to artificially inflate the domain authority of fake sites, allowing them to outrank legitimate projects in organic search results.
• Typo-Squatting: Registering domains with slight misspellings of popular tool names (e.g., ghidra-reverse[.]com vs. the official site).

The result is that unsuspecting developers searching for trusted tools are funneled directly into the attackers’ infrastructure.

The TDS Filter: Profiling Victims Before Delivery

When a user clicks “Download” on a fake site, they are not immediately served malware. Instead, they are redirected through a Traffic Distribution System (TDS). This intermediary layer acts as a sophisticated filtering mechanism, employing several techniques to profile visitors and evade detection:

• Anti-Bot Logic: Checking for automated analysis tools, sandboxes, or security researcher environments.
• First-Visit State: Ensuring a user hasn’t already been processed to avoid duplicate infections.
• VPN/Datacenter Filtering: Blocking traffic from known VPN providers or cloud IP ranges to focus on residential users.
• Geographic Targeting: Delivering different payloads based on the victim’s location.
• Frequency Capping: Limiting redirects per IP to avoid triggering abuse detectors.

One specific open-source TDS, zTDS, has been linked to the “DriveSurge” threat actor, who has hijacked thousands of legitimate websites since late 2025 to feed this network.

Malware Payloads: A Diverse Arsenal

Once a victim passes the TDS filters, they are served one of several malware families, each designed for specific criminal objectives:

1. Remus Stealer (MaaS)

A new information stealer offered as Malware-as-a-Service. It exfiltrates data from over 20 browsers, browser extensions, cryptocurrency wallets, and password managers. Believed to be a variant of Lumma Stealer, Remus is optimized for speed and stealth.

2. AnimateClipper

A cryptocurrency clipper that monitors the system clipboard. When it detects a copied wallet address, it silently replaces it with an attacker-controlled address. This malware supports over 20 blockchain ecosystems, hijacking transactions in real-time.

3. SessionGate Framework

A previously unknown, multi-stage loader with heavy obfuscation. SessionGate is used to deliver Potentially Unwanted Applications (PUA) while incorporating extensive anti-analysis features to evade detection by endpoint security tools.

4. ACRStealer

Specifically targeting users of popular AI and developer tools, this stealer focuses on harvesting API keys, credentials, and configuration files relevant to software development environments.

5. AsyncRAT & DinDoor (Deno RAT)

Remote Access Trojans distributed through fake installers on platforms like GitHub and SourceForge. DinDoor is often promoted via compromised YouTube channels offering “cracked” software tutorials.

6. WeedHack (MaaS)

An inexpensive Malware-as-a-Service tool providing remote access capabilities. It is frequently distributed through fake Minecraft mods and clients, leveraging the same SEO poisoning infrastructure.

Target Profile: Developers and AI Enthusiasts

This campaign demonstrates a clear understanding of its target demographic. The primary victims are:

• Developers: Searching for reverse-engineering tools (Ghidra, dnSpy), security scanners (SpiderFoot), or development utilities.
• AI Enthusiasts: Seeking unofficial installers for AI coding assistants like Claude Code or Google Gemini CLI.
• Budget-Conscious Users: Looking for “cracked” or “premium” versions of paid software, who are more likely to trust third-party download sites.

By focusing on technically inclined users, attackers increase the likelihood of successful infection, as these users often have elevated privileges on their systems and access to valuable intellectual property, API keys, and cloud infrastructure.

The Role of AI in Modern Malware

Threat actors behind this campaign are increasingly experimenting with AI models to enhance their operations:

• Code Obfuscation: Using AI to rewrite malware signatures and evade static detection.
• Vulnerability Discovery: Leveraging AI assistants to identify and weaponize zero-day exploits faster than defenders can patch.
• Social Engineering: Generating convincing fake documentation, release notes, and user testimonials to lend credibility to fraudulent sites.

This shift towards AI-driven malware development suggests that future campaigns will be even more evasive and targeted.

Recommendations for Developers and Organizations

To protect against this evolving threat, adopt the following security practices:

1. Verify Download Sources: Always download open-source tools from official repositories (GitHub, GitLab) or verified package managers (apt, brew, pip, npm). Never trust third-party “mirror” sites found via search engines.
2. Check URLs Carefully: Inspect the domain name for typos or subtle misspellings. Legitimate projects rarely use hyphenated or alternative TLDs for their main download pages.
3. Use Ad Blockers: Paid search ads are a primary vector for SEO poisoning. Tools like uBlock Origin can help identify sponsored results as potential risks.
4. Validate Checksums: Always verify SHA256 or GPG signatures provided by official projects. Fake binaries will not match legitimate checksums.
5. Sandbox Downloads: Execute newly downloaded tools in an isolated environment (VM, container) before running them on your primary development machine.
6. Monitor Network Traffic: Use firewalls or DNS filtering to block connections to known TDS infrastructure and malicious domains.
7. Educate Teams: Ensure all developers understand the risks of unofficial software sources and the signs of SEO poisoning attacks.

Conclusion

The fake open-source tools campaign underscores a critical vulnerability in the software supply chain: human trust. By weaponizing the very platforms developers rely on for discovery (Google Search) and distribution (GitHub, SourceForge), attackers have created a highly effective pipeline for malware delivery.

As AI continues to lower the barrier for creating convincing clones and evasive malware, the responsibility falls on individuals and organizations to adopt a zero-trust approach to software acquisition. In 2026, verifying the integrity of your tools is not just best practice—it’s a survival requirement.