Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem

Reported 03 Jun 2026 by otx · Severity: medium

A large-scale operation impersonates open-source and freeware projects to capture search traffic, targeting tools such as Ghidra, dnSpy, and SpiderFoot. The professionally designed sites load CloudFront-hosted JavaScript that converts download button clicks into handoffs to a Tra