Huge hacking campaign uses spoofed Ghidra, dnSpy, and SpiderFoot security tools to harvest ad revenue and serve malware

Hands on a laptop with overlaid logos representing network security.

• Over 100 spoofed sites mimic trusted security tools
• Campaign serves SessionGate, RemusStealer, AnimateClipper
• Primary goal appears to be traffic monetization

A large-scale malicious campaign was recently uncovered, spoofing reputable open-source security tools to harvest ad revenue and serve malware to developers and security researchers.