Cybersecurity researchers identified malicious NuGet packages disguised as game utilities that install spyware. Additionally, a financially motivated group is using trojanized software installers to deploy a sophisticated remote access tool aimed at U.S. and European users.
Cybersecurity researchers reported the presence of 11 malicious NuGet packages masked as .NET command-line tools. These packages refer to themselves as game utilities, with their primary function being to download and execute a second-stage Python payload named 'pepesoft.exe'.
The payload employs AWS-style keys to retrieve remote configurations and can communicate with Google Sheets. It is also designed to send screenshots via Telegram bot commands.
The financially motivated group UAT-11795 has been running campaigns using trojanized installers for various software, including developer tools and gaming applications. This has been ongoing since at least June 2025, targeting users in the U.S. and Europe. They deploy the Starland RAT and the WLDR command-and-control memory implant.
The WLDR agent showcases advanced capabilities, including encrypted communication and a Runspace execution engine, enabling it to execute further payloads. Victims’ credentials and cryptocurrency wallets are specific targets of the malware.
The majority of infections are reported in the U.S. with few impacts noted in Germany, indicating a geographic targeting strategy. Organizations may need to enhance security measures against such sophisticated threats. Immediate awareness and responsiveness are essential to mitigate potential damage.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
Cybersecurity researchers identified malicious NuGet packages disguised as game utilities that install spyware. Additionally, a financially motivated group is using trojanized software installers to deploy a sophisticated remote access tool aimed at U.S. and European users.