Executive Summary
Check Point Research has uncovered a sophisticated malware distribution campaign, dubbed SessionGate, which utilizes high-quality look-alike websites for popular open-source and security tools such as Ghidra and dnSpy. These sites leverage click-hijacking via CloudFront-hosted JavaScript to divert users through a Traffic Distribution System (TDS). This system employs strict gating, including anti-bot logic and VPN filtering, to selectively deliver malicious payloads while serving benign content to researchers or automated systems.
The campaign distributes several malware families, most notably the newly emerged RemusStealer, an infostealer targeting over 300 browser extensions including crypto wallets and password managers, and AnimateClipper, a cryptocurrency clipper. The SessionGate framework itself is a multi-stage loader designed with extreme obfuscation and server-side key release mechanisms that ensure a unique payload is generated for each victim, making static analysis and payload recovery exceptionally difficult for security teams.
This threat is particularly significant because it targets high-value technical users and security researchers. The use of legitimate CDNs and the ability to rank highly in search results increases the likelihood of successful infection. Organizations should prioritize monitoring for the specific TDS redirection domains and the unique execution patterns of the SessionGate loader.