Lookalike Open-Source Portals Are SEO-Climbing Their Way to Malware Delivery

Researchers have surfaced a sprawling campaign that clones the look of open-source and freeware project pages, then funnels visitors through a Traffic Distribution System (TDS) before dropping one of several malware families. Among the payloads: Remus Stealer, AnimateClipper, and a framework tracked as SessionGate.

The lure is mundane. Users search for a tool, click a result that looks like the official portal, and download something that runs.

The sites are convincing. They mimic the layout of legitimate project pages, sometimes referencing the actual upstream maintainers, and they rank well enough in search engines to compete with the real thing. SEO poisoning is the entire front end of the kill chain. The TDS is the switchboard behind it — fingerprinting the visitor, routing some to the malware, sending others (researchers, sandboxes, the wrong geography) to benign content so the operation stays quiet.

This is the part that should interest anyone working in identity.

Remus Stealer and similar info-stealers don't just grab saved passwords. They scrape browser session cookies, OAuth refresh tokens, and any locally cached SSO material they can find. Once those land on an attacker's server, the victim's MFA posture stops mattering for the duration of the stolen session. The attacker replays the cookie, the IdP sees a valid session, and the SP issues a SAML assertion or OIDC ID token as if nothing is wrong.

Would MFA have helped? Honestly, not much, not directly. Phishing-resistant authenticators stop credential theft at login. They do not stop a malware-resident token replay after a successful login on the victim's own machine. That gap is exactly what the stealer market monetizes.

What does help:

• Short-lived access tokens with aggressive refresh-token rotation per RFC 6749 §10.4 and the OAuth 2.0 Security BCP in RFC 9700. Rotation lets the IdP detect replay when two parties present the same refresh token.
• Device-bound sessions. DPoP (RFC 9449) and token binding cryptographically tie a token to a key the stealer can't easily exfiltrate. Adoption is uneven, but it is the structural fix.
• Continuous evaluation. CAEP-style signals from the IdP to relying parties so a flagged device terminates downstream sessions in seconds, not hours.
• Application allowlisting on endpoints that admins use for privileged work. The cheap control, still underused.

The campaign itself is a reminder that the supply chain for malware now starts at the search bar. The TDS layer means defenders can't reliably reproduce what victims saw, which complicates IOC sharing.

Auth proves who. Stolen cookies skip that step entirely. Plan accordingly.