11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload

This threat involves eleven malicious NuGet packages distributed as .NET command-line tools disguised as game cheats for titles like Albion Online and GTA5RP. Each package acts as a first-stage downloader that uses DNS-over-HTTPS to bypass local network controls and requests UAC elevation to resynchronize system time. They download a second-stage PyInstaller payload named pepesoft.exe from repositories on GitHub and Hugging Face under the username pepegit666. The payload enforces licensing through Google Sheets telemetry, binds to hardware fingerprints, respects remote ban-lists, and in three variants exposes Telegram bot commands for screenshot capture and remote control. All packages share identical AWS credentials and mutex identifiers, indicating a single Russian-speaking operator behind a commercial game-automation service promoted via pepesoft.ru and a Telegram channel.

The malicious packages enable unauthorized remote control of infected Windows hosts, including screenshot capture and execution of commands via Telegram bots. The payload’s hardware fingerprinting and licensing enforcement mechanisms complicate detection and removal. The use of DNS-over-HTTPS and UAC elevation requests facilitate evasion of local security controls. This supply chain compromise poses risks to developers and users who install these NuGet packages, potentially leading to surveillance and control of affected systems.

No official patches or vendor advisories are available for this threat. Mitigation involves avoiding installation of NuGet packages from untrusted sources, especially those masquerading as game cheats. Security teams should monitor for indicators of compromise related to pepesoft.exe, unusual DNS-over-HTTPS traffic, and unexpected UAC elevation requests. Blocking known malicious domains and repositories (e.g., GitHub and Hugging Face accounts associated with pepegit666) and restricting execution of unauthorized command-line tools can reduce risk.