SEO Poisoning Alert: Fake Open-Source Sites Funneling Users to Remus Stealer

Hey everyone,

Just came across the report about the large-scale operation pushing malware via fake open-source project portals. Threat actors are cloning the look of legitimate freeware sites—sometimes even referencing the actual project descriptions—to trick users searching for popular tools.

The attack chain uses a Traffic Distribution System (TDS) to vet victims before dropping payloads like Remus Stealer, AnimateClipper, and the SessionGate framework. Since these sites rank high on Google, it’s a nasty supply chain-style issue.

For those hunting on the endpoint, a lot of these droppers land in user Downloads. Here’s a PowerShell snippet to hunt for unsigned executables created in the last 24 hours:

Get-ChildItem -Path "$env:USERPROFILE\Downloads" -Recurse -Filter *.exe -File |
Where-Object { $_.CreationTime -gt (Get-Date).AddHours(-24) } |
ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    if ($sig.Status -ne 'Valid') {
        Write-Host "Suspicious: $($_.FullName) - Status: $($sig.Status)"
    }
}

Are you guys seeing an uptick in SEO poisoning alerts lately? How are you handling the balance between allowing developers to grab utilities and blocking these TDS redirects?