Fake software sites use click hijacking in traffic distribution

Researchers at Check Point have published a report on a large-scale ecosystem of fake open-source and freeware project sites that rank highly in search results. The sites look professional and impersonate download pages for well-known tools, including Ghidra, dnSpy and MQTT Explorer. One technique is that the sites preserve legitimate-looking download links pointing to the original project sites when users hover over them, while a CloudFront-hosted JavaScript staging layer intercepts and redirects the first download click. The victim is then routed through a Traffic Distribution System (TDS), where anti-analysis checks, one-time links, IP and browser gating and frequency caps complicate analysis before a subset of users end up with malicious downloads. Observed downstream payloads include, alongside adware, RemusStealer, AnimateClipper and SessionGate, a previously unknown multi-stage loader named by Check Point Research. The authors believe the main motivation is likely traffic acquisition and monetisation, although malicious downloads were observed.

What this means for your organisation

Developers, operations staff and security personnel regularly obtain tools via search, and this is precisely the group holding the highest privileges. When the fake site tops the search results and the link looks correct on inspection, advice to "check the link" is not sufficient as the only control. The consequence is malware installed by a trusted user on a trusted machine.

Berigo recommends

• Establish an internal, approved source for tooling so staff do not have to search their way to downloads.
• Verify checksums and signatures for software installed on administrative machines.
• Limit installation rights on workstations, including for technical roles, and elevate privileges only when needed.
• Monitor downloads of executable files from newly registered or unknown domains.

Source

• research.checkpoint.com