Attackers are using cloned websites for Ghidra, dnSpy, and SpiderFoot to funnel security researchers through a traffic filtering system that…