Check Point Research investigated an ongoing large-scale operation impersonating open-source and freeware projects to capture search traffic. Their well-designed sites often looked like legitimate project portals at a glance. Their deception, however, did not lie in their page content, they were spurred by user interactions.

The attacks loaded a CloudFront-hosted JavaScript staging layer that redirected user clicks to a traffic distribution system (TDS) with strict gating features. Their upstream ecosystem may have been built primarily to acquire and monetize traffic while their downstream redirect chains led selected users to malware delivery infrastructure for RemusStealer, AnimateClipper, and the SessionGate framework.

The researchers identified 27 network IoCs made up of subdomains, domains, and IP addresses. After extracting unique domains from the subdomains and domain legitimacy and activity checks aided by the WhoisXML API MCP Server, we compiled 30 IoCs comprising eight subdomains, 19 domains, and three IP addresses for further investigation.

Our DNS deep dive into the threat led to these discoveries:

• One client IP address that communicated with one of the domain IoCs
• One domain IoC that appeared in one typosquatting group with five members
• Three domain IoCs that were likely registered with malicious intent
• 22 unique IP addresses potentially owned by victims that communicated with two of the IP IoCs
• 2,892 email-connected domains, 11 of which were confirmed malicious
• 26 additional IP addresses, all of which were confirmed malicious
• 23 IP-connected domains, 10 of which were confirmed malicious
• 157 string-connected domains

A sample of the additional artifacts obtained from our analysis is available for download from our website.

Studying the RemusStealer, AnimateClipper, and SessionGate Subdomain IoCs

We began our in-depth IoC investigation by looking more closely at the eight subdomain IoCs.

We used the WhoisXML API MCP Server to analyze the subdomain IoCs and uncovered interesting findings. Take a look at more information for three examples shown below.

In sum, the hugo-lapp subdomain family is clearly part of a suspended or abusive infrastructure cluster. The apex domains—brightcanvas[.]digital and hugo-lapp[.]lat share the same registrar. The differences? While hugo-lapp[.]lat has been suspended, brightcanvas[.]digital remains live behind a Cloudflare IP address, which could mean it is still operational or has not been subjected to action yet. And while brightcanvas[.]digital had a redacted registrant email address, hugo-lapp[.]lat had a public but suspicious email address.

Our verdict? All subdomains under the two apex domains may be worth avoiding.

Dissecting the RemusStealer, AnimateClipper, and SessionGate Domain IoCs

Next, we zoomed in on the 19 domain IoCs.

First, sample network traffic data from the IASC revealed that one client IP address communicated with one of the domain IoCs via a single DNS query made on 30 April 2026.

The findings of our Typosquatting API queries for the domain IoCs, meanwhile, showed that the domain IoC ropea[.]top appeared in a typosquatting group along with four look-alikes—rosca[.]cn, rozea[.]co, rosea[.]lat, and rosca[.]health. The five group members were all registered on 19 February 2026.

We also learned from the results of our First Watch Malicious Domains Data Feed queries that three of the domain IoCs were likely registered with malicious intent 104—161 days before Check Point Research dubbed them as IoCs in their report published on 3 June 2026.

The domain IoC carlessclapped[.]com, for instance, was registered as far back as 24 December 2025, 161 days before the report publishing date.

Next, we queried the domain IoCs on WHOIS API and discovered that:

• They were created between 23 September 2025 and 4 March 2026, hinting that the threat actors could prefer using NRDs for their attacks.

  

• They were administered by five different registrars.

  

• While three did not have registrant countries on record, the remaining 16 were registered in five different countries.

  

The results of our DNS Chronicle API queries for the domain IoCs revealed that 16 recorded 181 historical domain-to-IP resolutions over time. Here are more details for five examples.

To date, all 16 domain IoCs with historical resolutions continue to resolve IP addresses.

Investigating the RemusStealer, AnimateClipper, and SessionGate IP IoCs

Next, we scrutinized the three IP IoCs.

First, sample network traffic data from the IASC revealed that 22 unique IP addresses that could belong to victims under two distinct ASNs communicated with two of the IP IoCs between 11 April and 8 June 2026.

We then queried the IP IoCs on Bulk IP Geolocation Lookup and discovered that:

• Each of them was geolocated in a different country, none of which matched any of the registrant countries of the domain IoCs identified earlier.

  

• While one did not have an ISP on record, the remaining two fell under the purview of two distinct administrators.

  

The results of our DNS Chronicle API queries for the IP IoCs showed that all three posted 333 historical IP-to-domain resolutions over time. The IP address 217[.]156[.]122[.]75, for instance, recorded 265 resolutions between 7 February 2017 and 21 April 2025.

As of this writing, only one of the IP IoCs continued to post domain resolutions in 2026.

Ammassing New RemusStealer, AnimateClipper, and SessionGate Artifacts

Next up, we expanded the current list of network IoCs beginning with WHOIS History API queries for the domain IoCs. We learned that 15 had 22 unique email addresses in their historical records. Further scrutiny showed that three were public email addresses.

We queried the public email addresses on Reverse WHOIS API and uncovered 2,892 unique email-connected domains after those tagged as IoCs were filtered out.

Threat Intelligence API queries for the email-connected domains showed that 11 have already been weaponized for various cyber attacks.

This post only contains a snapshot of the full research. Download the complete findings and a sample of the additional artifacts on our website or contact us to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

Disclaimer: We take a cautionary stance toward threat detection and aim to provide relevant information to help protect against potential dangers. Consequently, it is possible that some entities identified as “threats” or “malicious” may eventually be deemed harmless upon further investigation or changes in context. We strongly recommend conducting supplementary investigations to corroborate the information provided herein.