11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload

A cyber threat campaign has distributed 11 malicious NuGet packages masquerading as game utilities and cheat panels targeting Russian-speaking communities. These packages act as first-stage downloaders that fetch and execute a second-stage Windows payload named pepesoft.exe from GitHub and Hugging Face under the operator-controlled account pepegit666. The payload enables host surveillance, including hardware fingerprinting, Google Sheets-based telemetry, remote ban-list checks, and in some variants, Telegram-based remote control with screenshot exfiltration capabilities.

AI-extracted · verify before operational use