Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem

Research by: Alexey Bukhteyev Key Takeaways Check Point Research investigateda large-scale operation that impersonates open-source and freeware projects to capture search traffic, including lookalikes for researcher and security tooling such as Ghidra, dnSpy, and SpiderFoot. The sites are well-designed and often look like legitimate project portals at a glance, sometimes referencing real upstream resources. The deception is not in the page content alone, it’s in what happens when a user interact