RemusStealer / AnimateClipper / SessionGate — Fake Dev-Tool Sites (SEO + TDS)

A large malware-distribution ecosystem (Check Point Research, June 2026) that runs 100+ SEO-poisoned sites impersonating open-source developer/security tools (Ghidra, dnSpy, SpiderFoot, ILSpy, grpcurl, mqttexplorer, mfcmapi, CrystalDiskMark…). A CloudFront-hosted JavaScript layer turns a "Download" click into a handoff to a gated Traffic Distribution System (TDS) that delivers RemusStealer (20+ browsers, wallets, password managers, 2FA), AnimateClipper (clipboard wallet-address swapper), and SessionGate (heavily-obfuscated multi-stage loader). Defensive hunt & harden pack — no offensive code.

Threat

Fake dev-tool distribution ecosystem (SEO + TDS)

Severity

HIGH · STEALER + CRYPTO THEFT

Type

Infostealer · crypto clipper · multi-stage loader

Delivery

Spoofed tool sites → CloudFront JS → gated TDS

Targets

Developers, security researchers, IT/power users

Version

v0.2 · 2026-06-16

Author

HuntPack

Executive Summary

Check Point Research (June 2026) detailed a sprawling malware-distribution ecosystem that weaponizes the trust developers and security practitioners place in open-source tooling. The operators stood up 100+ websites impersonating popular open-source tools — Ghidra, dnSpy, SpiderFoot, ILSpy, grpcurl, mqttexplorer, mfcmapi, winsetupfromusb, CrystalDiskMark, guiformat and more — meticulously cloned (real GitHub links, authentic design) and pushed up Google rankings via SEO poisoning. The campaign has been active since at least December 2025, with confirmed delivery from January 2026 and 5,000+ related VirusTotal submissions.

Clicking "Download" loads a CloudFront-hosted JavaScript staging layer that hands the visitor to a gated Traffic Distribution System (TDS). The TDS fingerprints and filters victims, then serves one of three payloads: RemusStealer, a newly-emerged infostealer that loots data from 20+ browsers including cryptocurrency wallets, password managers, and 2FA/authenticator apps; AnimateClipper, a clipboard hijacker that silently swaps copied wallet addresses for attacker-controlled ones; and SessionGate, a heavily-obfuscated multi-stage loader with one-time-key delivery and extensive anti-analysis/validation logic (combined with TDS-side gating, this makes retrieving the final payload very hard for analysts).

⚠ Defender priority: The victims here are often your own technical staff downloading "the tool they always use." Hunt Q1 (a freshly browser-downloaded dev-tool installer executing from Downloads) and Q2 (a non-browser process mass-reading browser credential/wallet stores — RemusStealer). Because the final payload is TDS-gated and rotates, anchor on the delivery lineage and the stealer/clipper behavior, not a fixed hash.

Source Review & Web Hunter Notes

Tier	Source	Key Finding	Carry
1 · Vendor research	Check Point Research — Impersonation, Click Hijacking & TDS	100+ spoofed tool sites; CloudFront JS → TDS; RemusStealer/AnimateClipper/SessionGate; since Dec 2025	yes
1 · News	The Hacker News — fake open-source tool sites rank high on Google	SEO poisoning; tool list; TDS delivery; targeting of dev/security community	yes
2 · News	CyberSecurityNews / Hackread / GBHackers / TechRadar	Ghidra/dnSpy/SpiderFoot impersonation; 5,000+ VT submissions; ad-revenue + malware	partial

Decisions: behavior-first because the final payload is TDS-gated and rotates (no durable hash). Anchor on (1) the delivery lineage — a browser-downloaded "dev tool" run from Downloads, often via a CloudFront link; (2) RemusStealer's mass browser/wallet credential access; (3) AnimateClipper's clipboard-hijack persistence; (4) SessionGate's staged/obfuscated loader behavior. Spoofed domains rotate (100+), so treat them as a refreshable watchlist, not the primary signal. High relevance for orgs whose developers/SOC analysts pull these exact tools.

Hunt Brief & Attack Chain

Working hypothesis: A developer/analyst searches for a tool (e.g. dnSpy), lands on a spoofed top-ranked site, clicks Download → CloudFront JS → TDS serves a trojanized installer that runs from Downloads and deploys RemusStealer / AnimateClipper / SessionGate, leading to credential/wallet theft and clipboard hijacking.

Step	Behavior	Telemetry	Hunt Angle
1 · SEO lure	Spoofed tool site ranks high on Google	Proxy / browser history	N1
2 · TDS handoff	CloudFront JS → gated TDS fingerprints visitor	DNS; proxy	N2; Q5
3 · Delivery	Trojanized "tool" installer written to Downloads	file; `ProcessRollup2`	Q1; N3
4 · RemusStealer	Mass read of browser creds / wallets / 2FA	file access; `ProcessRollup2`	Q2
5 · AnimateClipper	Clipboard monitor swaps wallet addresses	persistence; `ProcessRollup2`	Q3
6 · SessionGate	Obfuscated multi-stage loader; one-time-key fetch	`ProcessRollup2`; net	Q4; Q5
7 · Exfil / C2	Stolen data + clipper config over web	`NetworkConnectIP4`; DNS	Q5; N2

Affected surface & telemetry

Surface	Required Telemetry	Priority	Gap Risk
Developer / analyst workstations	Process lineage + file write/read events	Critical	Low — process telemetry
Browser credential / wallet stores	File-access attribution (non-browser readers)	High	Medium — needs file-read visibility
Egress	DNS / proxy (CloudFront, TDS, C2)	Medium	Medium — CloudFront is shared/legit
Persistence	Run keys / scheduled tasks	Medium	Low

Consolidated IOC Table

The final payload is TDS-gated and rotates; the 100+ spoofed domains churn. The delivery lineage and the stealer/clipper/loader behaviors are the durable surface. Copy-ready blocks in §9.

Type	Value	Conf	Action	Context
Behavior	Browser-downloaded "dev tool" installer run from \Downloads	high	detect	Delivery — flagship
Behavior	Non-browser process mass-reading browser cred/wallet stores	high	detect	RemusStealer
Behavior	Clipboard-monitor persistence swapping wallet addresses	medium	hunt	AnimateClipper
Behavior	Obfuscated multi-stage loader; one-time-key fetch	medium	hunt	SessionGate
Infra	100+ spoofed tool domains; CloudFront JS staging; gated TDS	medium	hunt	Refreshable watchlist

ATT&CK Mapping

Tactic	Technique	Observed Behavior	Query / Control
Resource Dev / Initial Access	T1608.006 / T1189 — SEO poisoning / drive-by	Spoofed tool sites ranked via SEO	N1, N2
Execution	T1204.002 — User executes malicious file	Trojanized installer run from Downloads	Q1; N3
Credential Access	T1555.003 / T1539 — Browser creds / session cookies	RemusStealer loots 20+ browsers, wallets, 2FA	Q2
Collection / Impact	T1115 / T1565 — Clipboard / data manipulation	AnimateClipper swaps wallet addresses	Q3
Defense Evasion / Execution	T1027 / T1140 — Obfuscation / multi-stage load	SessionGate staged, one-time-key	Q4
Persistence	T1547.001 / T1053.005 — Run key / task	Stealer/clipper auto-start	Q6
Command & Control / Exfil	T1071 / T1041 — Web C2 / exfil	Stolen data over web; TDS/CloudFront	Q5; N2

Native Audit-Log Hunts

Hunt	Source	Logic	Response
N1 · Spoofed-site visits	Proxy / DNS / browser history	Visits to look-alike tool domains (typo/extra-word variants of ghidra/dnspy/spiderfoot/ilspy…) not the official repo/host	Block domain; warn user
N2 · TDS / CloudFront delivery	Proxy	A "tool" download served via a CloudFront JS handoff / TDS redirect chain rather than GitHub releases	Block; pull the file
N3 · Downloads execution	EDR / process	Execution of a just-downloaded installer from `\Downloads` with a dev-tool name but no valid/expected publisher signature	Isolate; triage
N4 · Browser cred-store access	EDR file audit	Non-browser processes opening Login Data / wallet / authenticator files	Treat as stealer; reset creds

CrowdStrike LogScale CQL Hunt Queries

Falcon cloud (drives "Open in Falcon"): Pick your tenant's cloud first — every "Open in Falcon" button below uses this selection.

Field names validated against the Falcon event reference; process hunts include SyntheticProcessRollup2. The final payload is TDS-gated and rotates — Q1 (delivery lineage) and Q2 (stealer file access) are the durable anchors. Baseline your sanctioned dev-tool installers to keep FPs low.

Q1 · Browser-downloaded dev-tool installer executing from Downloads

CONF HIGHFP LOW-MEDCOST LOW

Looks for: a process running from \Downloads whose name impersonates one of the spoofed tools, parented by a browser. Accomplishes: catches the trojanized-installer delivery. FP: low-med — legit users do download these; flag the Downloads path + unsigned/unexpected publisher and correlate to N2/N3.

// HUNT: spoofed dev-tool installer executed from Downloads (browser-delivered)
// MITRE: T1204.002, T1189 | CONF: high  FP: low-med  COST: low
// FP NOTES: legit downloads exist; flag \Downloads path + browser parent + unsigned
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/\\(Downloads|Temp)\\/i
| FileName=/^(ghidra|dnspy|ilspy|spiderfoot|grpcurl|mqttexplorer|mfcmapi|winsetupfromusb|crystaldiskmark|guiformat).*\.(exe|msi)$/i
| ParentBaseFileName=/^(chrome|msedge|firefox|brave|opera|explorer)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine], limit=200)

Q2 · RemusStealer — non-browser process reading browser cred/wallet stores

CONF HIGHFP MEDCOST MED

Looks for: a non-browser process touching many browser credential / wallet / authenticator files. Accomplishes: RemusStealer's core looting. FP: medium — some backup/security tools; require a high distinct-file count and a non-browser, user/temp-path image.

// HUNT: RemusStealer mass browser/wallet credential access
// MITRE: T1555.003, T1539 | CONF: high  FP: medium  COST: med
// TUNING: require many distinct targets + non-browser image; baseline backup/security tools
#event_simpleName=/FileOpenInfo/
| TargetFileName=/(\\User Data\\.+\\(Login Data|Web Data|Cookies|Local State)|\\wallet\.dat|\\Ethereum\\keystore|MetaMask|Local Extension Settings|Authy|\\2fa)/i
| ImageFileName!=/\\(chrome|msedge|firefox|brave|opera|opera_gx)\.exe$/i
| groupBy([ComputerName, ImageFileName], function=count(TargetFileName, distinct=true, as=files))
| files >= 6
| table([ComputerName, ImageFileName, files], limit=200)

Q3 · AnimateClipper — clipboard-hijack persistence

CONF MEDFP MEDCOST LOW

Looks for: a user/temp-path binary (delivered alongside the installer) persisting via Run key / task — the clipper that swaps wallet addresses. FP: medium — clipboard API use isn't in standard telemetry, so anchor on the lineage + persistence; correlate to Q1.

// HUNT: AnimateClipper persistence (clipboard wallet-swapper)
// MITRE: T1115, T1547.001 | CONF: medium  FP: medium  COST: low
// TUNING: clipboard reads are not in standard telemetry; anchor on Downloads-spawned
//         persistence and correlate to Q1; review for crypto-address swapping at IR
#event_simpleName=/AsepValueUpdate|ScheduledTaskRegistered|RegGenericValueUpdate/
| RegStringValue=/\\(Downloads|AppData|Temp|ProgramData)\\.+\.(exe|scr|com)$/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegStringValue], limit=200)

Q4 · SessionGate — staged loader spawning script/LOLBin children

CONF MEDFP MEDCOST LOW

Looks for: a Downloads/Temp-path installer spawning shells / LOLBins / script hosts (the multi-stage SessionGate loader). FP: medium — correlate to Q1 on the same host; flag the Downloads-path parent.

// HUNT: SessionGate multi-stage loader child execution
// MITRE: T1027, T1140 | CONF: medium  FP: medium  COST: low
// TUNING: correlate to Q1; flag Downloads/Temp-path parent spawning shells/LOLBins
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentImageFileName=/\\(Downloads|Temp|AppData)\\/i
| FileName=/^(powershell|pwsh|cmd|wscript|cscript|mshta|rundll32|regsvr32|conhost)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Q5 · TDS / CloudFront delivery & stealer C2 egress

CONF MEDFP MEDCOST MED

Looks for: a Downloads/Temp-path or non-browser process making outbound web connections (TDS one-time-key fetch / stealer exfil). FP: medium — CloudFront is shared/legit; flag the non-browser, user-path image and correlate to Q1/Q2.

// HUNT: TDS one-time-key fetch / stealer exfil from a user-path process
// MITRE: T1071, T1041 | CONF: medium  FP: medium  COST: med
// TUNING: CloudFront is shared; flag non-browser user-path image; correlate to Q1/Q2
#event_simpleName=NetworkConnectIP4
| ContextImageFileName=/\\(Downloads|Temp|AppData|ProgramData)\\/i
| ContextImageFileName!=/\\(chrome|msedge|firefox|brave|opera)\.exe$/i
| in(RemotePort, values=[80, 443, 8080, 8443])
| groupBy([ComputerName, ContextImageFileName, RemoteAddressIP4], function=count())
| table([ComputerName, ContextImageFileName, RemoteAddressIP4, _count], limit=200)

Q6 · Persistence for the stealer/clipper

CONF MED-HIGHFP LOW-MEDCOST LOW

Looks for: Run keys / scheduled tasks pointing at a user/temp-path binary created in the same window as the download. FP: low-med — correlate to Q1; flag Downloads/AppData targets.

// HUNT: stealer/clipper auto-start persistence
// MITRE: T1547.001, T1053.005 | CONF: med-high  FP: low-med  COST: low
// TUNING: correlate to Q1; legitimate dev tools rarely auto-start from Downloads/AppData
#event_simpleName=/AsepValueUpdate|ScheduledTaskRegistered/
| RegStringValue=/\\(Downloads|AppData\\Local\\Temp|ProgramData)\\.+\.(exe|scr|dll|com)/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegStringValue], limit=200)

CrowdStrike Custom IOA Recommendations

IOA Name	Field Patterns	Benign Exclusions	Deployment Path
FakeTool — browser→Downloads installer	Parent `chrome/msedge/firefox.exe`; Child a dev-tool-named `.exe/.msi` in `\Downloads`, unsigned/unexpected publisher	Sanctioned internal tool distribution (allow-list signers)	Endpoint Security → Custom IOA → Process Creation, Detect
FakeTool — browser cred-store theft	Non-browser image reading multiple `Login Data`/wallet/2FA files	Vetted backup/security tooling	Custom IOA → File access, Detect+Block

Q2 (browser/wallet theft) is a strong, generalizable promotion — it catches RemusStealer and most other infostealers. Q1 is high-value where developers/analysts are common. The spoofed-domain list is a refreshable network watchlist (N1/N2), not an IOA.

Machine-Readable IOC Appendix

Grouped IOC Quick-Copy

One-click blocks for detection. The TDS-gated payload + 100+ domains rotate — behavior is the durable surface. Add per-incident atoms (sample hashes, resolved C2, confirmed spoof domains) during triage.

Behavioral Signaturesdetection logic

Browser (chrome/edge/firefox/brave) -> dev-tool-named installer executing from \Downloads (unsigned/unexpected publisher)
Non-browser process reading many browser Login Data / Web Data / Cookies / wallet.dat / MetaMask / Authy files (RemusStealer)
User/temp-path binary persisting via Run key / scheduled task (clipper/stealer)
Downloads/Temp-path installer spawning powershell/cmd/mshta/rundll32 (SessionGate staged loader)
Non-browser user-path process beaconing 80/443 (TDS one-time-key fetch / exfil)
Tool "download" served via a CloudFront JS handoff / TDS redirect instead of GitHub releases

Impersonated Tools (lure set)SEO targets

# Open-source tools whose download sites are being spoofed (100+ domains, churning):
ghidra
dnSpy
SpiderFoot
ILSpy
grpcurl
mqttexplorer
mfcmapi
winsetupfromusb
CrystalDiskMark
guiformat
# Rule: only fetch these from the official GitHub repo / vendor release page.
# Treat any other top-ranked "download" domain for these names as suspect.

Named Payloadscampaign

RemusStealer   # infostealer: 20+ browsers, crypto wallets, password managers, 2FA/authenticator apps
AnimateClipper # clipboard hijacker: swaps copied crypto wallet addresses for attacker-controlled ones
SessionGate    # heavily-obfuscated multi-stage loader, one-time-key delivery, anti-analysis + TDS gating
# Delivery: SEO-poisoned spoofed tool sites -> CloudFront JS staging -> gated TDS -> payload
# Active since ~Dec 2025; delivery confirmed Jan 2026; 5,000+ related VirusTotal submissions
# Tracking: Check Point Research "Impersonation, Click Hijacking, and TDS"

Hardening / Blockdefense-in-depth

Developer guidance: fetch tools ONLY from the official GitHub repo / vendor page (bookmark them)
Block known spoofed tool domains at proxy/DNS; alert on tool-name look-alike domains (N1/N2)
App control (WDAC/AppLocker): constrain execution from \Downloads on dev/analyst hosts
Promote Q2 (browser/wallet cred theft) to Detect+Block; promote Q1 where devs are common
Browser-stored-credential + wallet hygiene; hardware 2FA where possible
Egress: flag non-browser user-path processes beaconing 80/443; baseline CloudFront use

Hardening — Tiered & Deployable

Cut the trusted-download lure, constrain Downloads execution, and protect browser secrets.

Immediate — Break the lure

Developer guidance: pull tools only from the official GitHub repo / vendor page (bookmark them) — M1017. The campaign relies on a wrong-site download — the cheapest fix.
Block known spoofed tool domains; alert on look-alike domains — M1021 / M1037. Feeds N1/N2.
Promote Q2 (browser/wallet theft) to Detect+Block — M1040. Generalizes to most stealers.
App control: constrain execution from \Downloads on dev/analyst hosts — M1038. Breaks Q1.

Near term — Constrain & observe (pilot first)

WDAC/app allowlisting for dev tooling; block unsigned installers — M1045 / M1038.
Browser-credential + wallet hygiene; hardware 2FA — M1032. Blunts what RemusStealer can monetize.
Egress control: flag non-browser user-path processes beaconing the web — M1037. Feeds Q5.

Strategic — Reduce stealer surface

Internal vetted-tool mirror/repo for developers & SOC analysts — M1051. Removes the need to Google-and-download.
Application allowlisting fleet-wide; default-deny user-path execution — M1038.
Phishing-resistant MFA + session-token protections to limit stolen-cookie reuse — M1032.

Containment Runbook

Phase	Actions	Owner	Evidence
Isolate	Network-contain the host; preserve the downloaded installer + any dropped binaries + browser profile	SOC L2	Containment timestamp; Q1 event; sample
Triage	Map download → execution → stealer file access → persistence → egress; identify which browsers/wallets/2FA were read; pull the spoof domain + TDS chain	IR	Process tree; file-access list; domains
Eradicate	Remove the installer + stealer/clipper/loader + persistence; block the spoof domain/C2	IR	Removal log
Recover	Assume credential + session-cookie + wallet compromise: force-reset passwords, revoke browser sessions/tokens, rotate any seed phrases / move funds, re-enroll 2FA; reimage if loader ran	IR + IT + user	Cred reset; token revoke; wallet moves
Harden	Block spoof domains; app control on Downloads; promote Q1/Q2; brief the dev/SOC teams	Detection Eng	IOA enabled; domain blocks

Because RemusStealer targets crypto wallets + clipboard-swapping (AnimateClipper), treat any wallet activity on the host as untrusted until keys are rotated and balances verified — clipboard swaps can have already redirected funds.

Detection Coverage Map & Validation

Technique	Behavior	CQL	IOA	Coverage
T1204.002 / T1189	Trojanized installer from Downloads	Q1	IOA-1	Good + app control
T1555.003 / T1539	RemusStealer browser/wallet theft	Q2	IOA-2	Good
T1115 / T1547.001	AnimateClipper clipboard hijack	Q3	—	Partial clipboard not in telemetry
T1027 / T1140	SessionGate staged loader	Q4	—	Partial correlate to Q1
T1071 / T1041	TDS fetch / exfil	Q5	—	Partial + proxy (N2)
T1547.001 / T1053.005	Persistence	Q6	—	Good
T1608.006	SEO-poisoned spoofed sites	—	—	GAP proxy/DNS watchlist (N1)

Validation gates: (1) confirm process + file-access + DNS/proxy telemetry; (2) baseline sanctioned dev-tool installers + their signers + any backup/security tools that read browser files; (3) lab-test a benign download-and-run of a real tool (tune Q1 to require unsigned/unexpected publisher) and a benign browser-profile read (must NOT fire Q2 below the distinct-file threshold); (4) block known spoof domains + promote Q1/Q2. No durable payload hash — anchor on behavior.

Hunt Summary Ticket

TITLE:        Hunt — Fake Dev-Tool Sites (SEO+TDS): RemusStealer / AnimateClipper / SessionGate
SEVERITY:     High (credential + crypto-wallet theft; targets developers/analysts)
SCOPE:        Developer/SOC/IT workstations; browser secret stores; egress
HYPOTHESIS:   A user downloads a "dev tool" from a spoofed top-ranked site -> CloudFront JS -> TDS
              -> trojanized installer runs from Downloads -> RemusStealer (browser/wallet/2FA theft)
              + AnimateClipper (clipboard wallet-swap) + SessionGate (multi-stage loader).
QUERIES RUN:  Q1 Downloads installer (IOA) | Q2 browser/wallet theft (IOA) | Q3 clipper persistence |
              Q4 SessionGate loader | Q5 TDS/exfil egress | Q6 persistence
              + Native N1-N4 (spoofed-site visits, TDS/CloudFront delivery, Downloads exec, cred-store access)
DO FIRST:     Q1, Q2 -- escalate any browser/wallet mass-read on a non-IT host
FINDINGS:     <pending analyst execution>
GAPS:         SEO/spoof delivery (proxy/DNS); clipboard reads not in telemetry; payload TDS-gated/rotating
ACTIONS:      Dev-tool source guidance; block spoof domains; app control on Downloads; promote Q1/Q2;
              assume cred+cookie+wallet compromise on any hit (reset/rotate/revoke)
OWNER:        HuntPack
VERSION:      v0.2 - 2026-06-16

Changelog

v0.42026-07-24CQL correctness pass. All table() calls now carry an explicit row limit: the default is 200 and truncation is silent, so a capped result was indistinguishable from a complete one. Atomic-IOC sweeps (filters over 5+ hashes or C2 IPs) use limit=max so a wide infection is never silently under-scoped; behavioural hunts use limit=200, where exceeding the cap indicates the query needs tuning. Where present, event names that do not exist in the Falcon data model were corrected (e.g. ServiceInstalled is a Sysmon concept, not a Falcon event; ElfFileWritten is ELFFileWritten) — such queries could never return a row. No detection logic, fields, or IOCs changed.

v0.32026-06-29CQL syntax review (crowdstrike-logscale-v3): ImageFileName→ContextImageFileName on network event and regex-on-numeric RemotePort→in() (Q5).

v0.22026-06-16Re-published with refreshed metadata — index now shows Updated 2026-06-16 over the original Added date (2026-06-12). No detection-content changes.

v0.12026-06-12Initial pack, built in the review-v2 gold layout (fixed left-sidebar scrollspy TOC, collapsible, cloud selector inside the CQL section, per-card Copy/Open-in-Falcon, Grouped IOC Quick-Copy grid, coverage+validation, .ticket). Research from Check Point Research + The Hacker News (June 2026): 100+ SEO-poisoned spoofed open-source tool sites → CloudFront JS → gated TDS delivering RemusStealer (browser/wallet/2FA theft), AnimateClipper (clipboard wallet-swap), and SessionGate (obfuscated multi-stage loader). 6 CQL + 4 native hunts, 2 IOA candidates; behavior-anchored (TDS-gated payload, churning domains).

References

Tier	Source	Used For
1	Check Point Research — Impersonation, Click Hijacking, and TDS	Ecosystem, TDS, RemusStealer/AnimateClipper/SessionGate, spoofed tools
1	The Hacker News — Fake sites mimicking open-source tools rank high on Google	SEO poisoning, tool list, TDS delivery, dev/security targeting
2	CyberSecurityNews · Hackread · Check Point 8th June Threat Intel Report	Corroboration; 5,000+ VT submissions; CloudFront staging

HuntPack v0.2 · Fake Dev-Tool Sites (RemusStealer / AnimateClipper / SessionGate) · Generated 2026-06-12 · Updated 2026-06-16 · Defensive use only — no offensive code. The final payload is TDS-gated and the 100+ spoofed domains churn, so anchor on the delivery lineage (browser → Downloads installer) and the stealer/clipper behavior, not a fixed hash. Validate field names and baseline sanctioned dev-tool installers before promoting any query.