# ThreatsDay: 15+ Attack Campaigns This Week Show Why Default Trust Is Dead


The inbox never stops. This week, 15 confirmed attack campaigns hit organizations across North America, Europe, and Asia—and most of them work because defenders built their trust model around things that look familiar.


A NuGet package that claims to automate game scripts. An installer for industry-standard tools like WebEx or DBeaver. A Chrome browser sync feature toggled on by default. Each one is a handoff point where legitimacy ends and compromise begins. The speed and reach of these attacks—some completing lateral movement in under 24 hours—reflect a shift: attackers are no longer racing to find zero-days. They're perfecting the social contract itself.


## The Threat: Multiple Coordinated Attack Vectors


This week's landscape breaks into three dominant threat patterns:


### 1. Supply Chain Compromise via NuGet (Malicious Game Cheats)

Eleven malicious packages published to the public NuGet repository, masquerading as .NET command-line game utilities and automation tools, have been actively downloading and executing a Windows surveillance payload called pepesoft.exe. The attack chain works like this:


  • Initial vector: Developer or gamer downloads what appears to be a legitimate game cheat or bot automation tool from NuGet
  • First-stage downloader: The malicious NuGet package executes, then fetches the second-stage Python payload from GitHub Releases or Hugging Face repositories under the username "pepegit666"
  • Persistent capability: The payload uses AWS-style key material to retrieve remote configuration, authenticates to Google Sheets for command-and-control, and maintains a dormant BitTorrent fallback mechanism
  • Surveillance module: In multi-payload variants, the malware exposes Telegram bot commands capable of sending screenshots to attacker-controlled chat groups
  • Hardware fingerprinting: The malware binds activations to specific hardware and enforces a remote HWID/UUID ban-list, preventing reinfection of already-compromised systems

  • Impact scope: Primarily Windows developers and gaming enthusiasts, though the use of legitimate cloud services (Google Sheets, GitHub, Hugging Face) for C2 communication makes detection harder for network-based defenses.


    ### 2. Trojanized Installer Campaign (Starland RAT + WLDR Agent)

    Threat actor: UAT-11795, a Russian-speaking, financially motivated adversary active since at least June 2025.


    Attack surface: Social engineering targeting users in the U.S. and Europe through fake installers for trusted enterprise and consumer software:

  • Developer tools (MobaXterm, DBeaver)
  • Collaboration platforms (WebEx, Zoom)
  • IT administration utilities
  • Consumer gaming applications (FaceIT)

  • Malware payloads deployed:


    | Malware | Type | Capability |

    |---------|------|-----------|

    | Starland RAT | Python-based remote access tool | Full system access, credential theft |

    | WLDR Agent | PowerShell-based C2 memory implant | Encrypted beaconing, task queuing, in-memory payload execution |

    | CastleStealer / Remcos RAT | Information stealer + RAT | Credential harvesting, Active Directory enumeration |


    Attack chain breakdown:

    1. ClickFix social engineering lures direct victims to malicious download pages

    2. HTA scripts execute and download trojanized installers

    3. Installer drops Starland RAT for initial access

    4. Starland uses curl.exe to invoke PowerShell stager

    5. PowerShell decrypts and executes WLDR agent for persistence

    6. WLDR runs in-memory, evading disk-based detection


    Objectives: Harvest user credentials, steal cryptocurrency wallet assets, enumerate Active Directory, establish persistent C2 for follow-on payload delivery.


    Geographic concentration: Majority infections in the U.S., with secondary impacts in Germany, Romania, and Venezuela.


    ### 3. Spirals Ransomware: 24-Hour Encryption

    Rust-based ransomware family observed encrypting a South Asian IT services company's entire network in under 24 hours (June 2026). Whether Spirals is a newly discovered family or a purpose-built variant remains unclear.


    Significance: The speed of network encryption—from initial breach to full encryption in a single day—leaves minimal window for detection, response, and isolation. Traditional backup recovery and incident response timelines become useless.


    ## Background and Context


    ### The Expansion of ClickFix

    ClickFix has evolved beyond simple installer distribution. This week, it also served as a distribution vector for:

  • TELEPUZ, a modular malware family
  • ClickLock Stealer, a macOS-focused wallet and credential thief targeting users across North America, Europe, and the Middle East

  • ClickLock Stealer's scope illustrates attacker thoroughness:

  • Browser data: 8 major browsers
  • Crypto wallets: 31 browser extension wallets + 8 desktop applications
  • Blockchain extraction: Addresses across 6 different blockchain networks
  • System artifacts: macOS Keychain data, shell history, FTP credentials
  • Password managers: Steals data from 7 password manager extensions

  • ### Pattern Recognition: Why This Matters Now

    The convergence of three independent attack campaigns on the same week points to a systemic vulnerability in how organizations evaluate trust:


    1. Supply chain fatigue: NuGet, npm, PyPI, and other package repositories now face constant malicious publisher campaigns. Defenders can no longer assume popular packages are safe.


    2. Social engineering at scale: Trojaned installers for mainstream software (WebEx, Zoom, DBeaver) exploit the assumption that download pages are legitimate. Certificate pinning and code signing are verified by most users visually, not cryptographically.


    3. Speed as a weapon: 24-hour encryption timelines mean traditional incident response (detection → containment → investigation) is no longer feasible. Prevention must occur at the initial access layer, not during lateral movement.


    ## Technical Details: Attack Infrastructure


    ### Pepesoft.exe C2 Architecture

    The NuGet-distributed malware uses a hybrid C2 model:

  • Primary: Google Sheets API for command retrieval and exfiltration (encrypted)
  • Secondary: GitHub and Hugging Face as payload hosting
  • Fallback: Dormant BitTorrent mechanism for resilience
  • Authentication: AWS-style key material (likely SigV4-signed requests)

  • This multi-channel approach makes blocking expensive—defenders would need to block legitimate cloud services or accept the communications.


    ### WLDR Agent: Memory-Only Persistence

    The PowerShell-based WLDR agent operates entirely in-memory:

  • No disk artifacts to detect via file system scanning
  • Encrypted beaconing prevents network-based signatures
  • Task queuing allows delayed execution, obscuring command chains
  • Runspace execution engine isolates payload execution context

  • ### Spirals Encryption Speed

    The 24-hour encryption timeline suggests:

  • Pre-staging of encryption payloads across compromised systems before activation
  • Possible exploitation of weak network segmentation (ransomware able to reach all systems from initial access point)
  • Minimal Active Directory security hardening (e.g., no segmentation by resource type or sensitivity level)

  • ## Implications for Organizations


    ### Development and DevOps Teams

  • NuGet supply chain risk: Audit all installed NuGet packages for source legitimacy. Implement package pinning and SRI (Subresource Integrity) verification where available.
  • Installer trust: Use official vendor download sites only. Verify installer signatures and file hashes against vendor-published values.
  • Credential exposure: Review GitHub, Azure DevOps, and Docker Hub for leaked credentials in git history.

  • ### Enterprise IT

  • Installer verification: Deploy application whitelisting or code signing policy enforcement. Require digital signature validation for all installers.
  • Network segmentation: Assume lateral movement will occur. Implement zero-trust network access and microsegmentation by role and data sensitivity.
  • Ransomware resilience: 24-hour encryption timelines invalidate traditional backup retention windows. Implement immutable backups with offline copies refreshed daily.
  • Active Directory hardening: Enable tiering (Tier 0 for domain admin, Tier 1 for servers, Tier 2 for workstations). Restrict lateral movement paths via RBAC and Just-In-Time access.

  • ### Security Operations

  • ClickFix tracking: Maintain list of known ClickFix landing pages and distribute to phishing filter teams. Monitor for new domains.
  • Behavioral detection: Implement detection for PowerShell downloader patterns (curl + base64 decoding + in-memory execution).
  • Chrome Sync monitoring: If Chrome Sync is enabled in your environment, audit browser sync activity for signs of credential exfiltration or stalking behavior.

  • ## Recommendations


    | Priority | Action | Owner | Timeline |

    |----------|--------|-------|----------|

    | CRITICAL | Audit all active NuGet, npm, PyPI packages against known malicious publishers | Development | This week |

    | CRITICAL | Deploy code signing enforcement for all installers and executables | IT Security | 1–2 weeks |

    | HIGH | Implement immutable, offline-backed snapshots for business-critical systems | IT Operations | 2–4 weeks |

    | HIGH | Enable Active Directory tiering and JIT access controls | IT Security | 4–8 weeks |

    | MEDIUM | Conduct ClickFix phishing awareness training across organization | Security Awareness | 2 weeks |

    | MEDIUM | Audit browser sync configurations (Chrome, Edge, Firefox) for unintended exposure | IT Compliance | 2 weeks |


    ---


    ## HackWire Analysis


    The through-line this week isn't technical sophistication—it's trust asymmetry at scale. Attackers have spent years training users to click installers, developers to trust package repositories, and enterprises to assume that well-known software is safe. The payoff is now visible: campaigns like UAT-11795 don't need zero-days; they move faster than institutional response.


    What's particularly troubling is the speed vs. complexity tradeoff. Spirals ransomware encrypts entire networks in 24 hours, which means it's likely not performing complex post-breach reconnaissance or Advanced Persistent Threat (APT)-style exfiltration. It's just moving laterally and locking everything down. This speed is only possible if the network was already poorly segmented or the initial access point had excessive privilege.


    The same logic applies to the NuGet campaign: Why use sophisticated cryptography or obfuscation if legitimate cloud services (Google Sheets, GitHub, Hugging Face) are already trusted by the host system? The attacker relies on defenders *not* having inventory of what their machines are downloading and from where.


    The missed opportunity: Most organizations still treat incident response as a "when" problem rather than a prevention problem. With 24-hour encryption timelines, incident response is already too late. Prevention moves upstream: package pinning, code signing enforcement, network segmentation, and assumption of breach for third-party installers.


    For defenders in mid-market and enterprise environments, the lesson is uncomfortable: the difference between "compromised in 24 hours" and "detected in 24 hours" is infrastructure you build *before* an attack starts. Browser sync stalking, credential theft via installer trojans, and ransomware-as-a-service campaigns all exploit the same gap—trust in things that look legitimate. Close the gap, or accept that the handoff is already compromised.


    HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Tools](https://www.hackwire.news/category/tools) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)