# ThreatsDay: 15+ Attack Campaigns This Week Show Why Default Trust Is Dead
The inbox never stops. This week, 15 confirmed attack campaigns hit organizations across North America, Europe, and Asia—and most of them work because defenders built their trust model around things that look familiar.
A NuGet package that claims to automate game scripts. An installer for industry-standard tools like WebEx or DBeaver. A Chrome browser sync feature toggled on by default. Each one is a handoff point where legitimacy ends and compromise begins. The speed and reach of these attacks—some completing lateral movement in under 24 hours—reflect a shift: attackers are no longer racing to find zero-days. They're perfecting the social contract itself.
## The Threat: Multiple Coordinated Attack Vectors
This week's landscape breaks into three dominant threat patterns:
### 1. Supply Chain Compromise via NuGet (Malicious Game Cheats)
Eleven malicious packages published to the public NuGet repository, masquerading as .NET command-line game utilities and automation tools, have been actively downloading and executing a Windows surveillance payload called pepesoft.exe. The attack chain works like this:
Impact scope: Primarily Windows developers and gaming enthusiasts, though the use of legitimate cloud services (Google Sheets, GitHub, Hugging Face) for C2 communication makes detection harder for network-based defenses.
### 2. Trojanized Installer Campaign (Starland RAT + WLDR Agent)
Threat actor: UAT-11795, a Russian-speaking, financially motivated adversary active since at least June 2025.
Attack surface: Social engineering targeting users in the U.S. and Europe through fake installers for trusted enterprise and consumer software:
Malware payloads deployed:
| Malware | Type | Capability |
|---------|------|-----------|
| Starland RAT | Python-based remote access tool | Full system access, credential theft |
| WLDR Agent | PowerShell-based C2 memory implant | Encrypted beaconing, task queuing, in-memory payload execution |
| CastleStealer / Remcos RAT | Information stealer + RAT | Credential harvesting, Active Directory enumeration |
Attack chain breakdown:
1. ClickFix social engineering lures direct victims to malicious download pages
2. HTA scripts execute and download trojanized installers
3. Installer drops Starland RAT for initial access
4. Starland uses curl.exe to invoke PowerShell stager
5. PowerShell decrypts and executes WLDR agent for persistence
6. WLDR runs in-memory, evading disk-based detection
Objectives: Harvest user credentials, steal cryptocurrency wallet assets, enumerate Active Directory, establish persistent C2 for follow-on payload delivery.
Geographic concentration: Majority infections in the U.S., with secondary impacts in Germany, Romania, and Venezuela.
### 3. Spirals Ransomware: 24-Hour Encryption
Rust-based ransomware family observed encrypting a South Asian IT services company's entire network in under 24 hours (June 2026). Whether Spirals is a newly discovered family or a purpose-built variant remains unclear.
Significance: The speed of network encryption—from initial breach to full encryption in a single day—leaves minimal window for detection, response, and isolation. Traditional backup recovery and incident response timelines become useless.
## Background and Context
### The Expansion of ClickFix
ClickFix has evolved beyond simple installer distribution. This week, it also served as a distribution vector for:
ClickLock Stealer's scope illustrates attacker thoroughness:
### Pattern Recognition: Why This Matters Now
The convergence of three independent attack campaigns on the same week points to a systemic vulnerability in how organizations evaluate trust:
1. Supply chain fatigue: NuGet, npm, PyPI, and other package repositories now face constant malicious publisher campaigns. Defenders can no longer assume popular packages are safe.
2. Social engineering at scale: Trojaned installers for mainstream software (WebEx, Zoom, DBeaver) exploit the assumption that download pages are legitimate. Certificate pinning and code signing are verified by most users visually, not cryptographically.
3. Speed as a weapon: 24-hour encryption timelines mean traditional incident response (detection → containment → investigation) is no longer feasible. Prevention must occur at the initial access layer, not during lateral movement.
## Technical Details: Attack Infrastructure
### Pepesoft.exe C2 Architecture
The NuGet-distributed malware uses a hybrid C2 model:
This multi-channel approach makes blocking expensive—defenders would need to block legitimate cloud services or accept the communications.
### WLDR Agent: Memory-Only Persistence
The PowerShell-based WLDR agent operates entirely in-memory:
### Spirals Encryption Speed
The 24-hour encryption timeline suggests:
## Implications for Organizations
### Development and DevOps Teams
### Enterprise IT
### Security Operations
## Recommendations
| Priority | Action | Owner | Timeline |
|----------|--------|-------|----------|
| CRITICAL | Audit all active NuGet, npm, PyPI packages against known malicious publishers | Development | This week |
| CRITICAL | Deploy code signing enforcement for all installers and executables | IT Security | 1–2 weeks |
| HIGH | Implement immutable, offline-backed snapshots for business-critical systems | IT Operations | 2–4 weeks |
| HIGH | Enable Active Directory tiering and JIT access controls | IT Security | 4–8 weeks |
| MEDIUM | Conduct ClickFix phishing awareness training across organization | Security Awareness | 2 weeks |
| MEDIUM | Audit browser sync configurations (Chrome, Edge, Firefox) for unintended exposure | IT Compliance | 2 weeks |
---
## HackWire Analysis
The through-line this week isn't technical sophistication—it's trust asymmetry at scale. Attackers have spent years training users to click installers, developers to trust package repositories, and enterprises to assume that well-known software is safe. The payoff is now visible: campaigns like UAT-11795 don't need zero-days; they move faster than institutional response.
What's particularly troubling is the speed vs. complexity tradeoff. Spirals ransomware encrypts entire networks in 24 hours, which means it's likely not performing complex post-breach reconnaissance or Advanced Persistent Threat (APT)-style exfiltration. It's just moving laterally and locking everything down. This speed is only possible if the network was already poorly segmented or the initial access point had excessive privilege.
The same logic applies to the NuGet campaign: Why use sophisticated cryptography or obfuscation if legitimate cloud services (Google Sheets, GitHub, Hugging Face) are already trusted by the host system? The attacker relies on defenders *not* having inventory of what their machines are downloading and from where.
The missed opportunity: Most organizations still treat incident response as a "when" problem rather than a prevention problem. With 24-hour encryption timelines, incident response is already too late. Prevention moves upstream: package pinning, code signing enforcement, network segmentation, and assumption of breach for third-party installers.
For defenders in mid-market and enterprise environments, the lesson is uncomfortable: the difference between "compromised in 24 hours" and "detected in 24 hours" is infrastructure you build *before* an attack starts. Browser sync stalking, credential theft via installer trojans, and ransomware-as-a-service campaigns all exploit the same gap—trust in things that look legitimate. Close the gap, or accept that the handoff is already compromised.
— HackWire Editorial
---
## Related Coverage