ThreatCluster

Malicious NuGet Packages Deploy Windows Surveillance Malware to Gamers

First seen 15 Jul 2026, 15:27 UTC • •66

Article Content

1 / 3

Browse articles

ThreatCluster •July 16, 2026 at 13:35 UTC

•Eleven malicious NuGet packages masquerading as game cheats have been discovered.
•The packages deploy pepesoft.exe, enabling remote access and surveillance of infected PCs.
•Targeted gaming communities include Albion Online and GTA5RP, posing risks to user privacy.

Eleven malicious NuGet packages disguised as game cheats and automation tools have been identified, deploying a Windows payload known as pepesoft.exe. These packages target gaming communities, particularly for titles like Albion Online and GTA5RP. Once installed, they provide attackers with remote access to victims' PCs, allowing for live screenshot capture and other surveillance activities. The attack method exploits the .NET command-line tool installation process, making it easy for users to inadvertently execute the malicious code. The scope of the impact includes multiple gaming communities, with significant risks to user privacy and system security. Currently, there are no specific CVEs associated with these packages, but the threat is active and ongoing. Users are advised to avoid downloading unofficial game-related packages.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 91d ago How this analysis works

Timeline

2026-07-15

Malicious NuGet packages identified

Researchers uncovered 11 malicious packages that deploy Windows surveillance malware targeting gamers.

2026-07-15

Remote access capabilities confirmed

The malicious packages allow attackers to capture live screenshots and control victims' machines remotely.

Cybersecuritynews

More articles in this cluster (2)

Threat Graph

9 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Malware
T1036 - Masquerading
T1056 - Input Capture
T1059 - Command and Scripting Interpreter
T1195 - Supply Chain Compromise

Malware (1)

Pepesoft

Affected Platform (2)

Windows
NuGet

Tool (1)

Dotnet

Relationships

Malware targets Windows
Malware targets NuGet
T1036 - Masquerading targets Windows
T1036 - Masquerading targets NuGet
T1056 - Input Capture targets Windows
T1056 - Input Capture targets NuGet
T1059 - Command and Scripting Interpreter targets Windows
T1059 - Command and Scripting Interpreter targets NuGet
T1195 - Supply Chain Compromise targets Windows
T1195 - Supply Chain Compromise targets NuGet
Pepesoft related to Dotnet

Following this threat?

Track Pepesoft in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…

Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…