Threats Day: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories
Summary: Researchers found 11 malicious NuGet packages posing as .NET game utilities, bots, and panels that act as first-stage downloaders fetching a second-stage Python payload named "pepesoft.exe" from GitHub Releases and Hugging Face paths under the username "pepegit666," with a dormant BitTorrent fallback. A South Asian IT services company was hit by a new Rust-based ransomware family called Spirals in June 2026, with the payload pushed to network machines less than 24 hours after initial access gained through an internet-facing IIS web server and an ASP.NET web shell.
Key Takeaway: The Spirals intrusion went from web shell to network-wide ransomware deployment in under 24 hours, after the attacker spent three hours uninstalling endpoint security and dumping the SAM hive - a timeline that leaves little room for a slow detection-and-response cycle. Separately, 292 fake GitHub repositories impersonating vendors including Arctic Wolf distributed an in-memory infostealer with a 41-entry cryptocurrency wallet path table, exfiltrating stolen data to a command-and-control server hosted in Russia.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026