New research uncovered 11 malicious NuGet packages disguised<\/a> as game cheats, bots, and management panels for popular online titles. The campaign targets gaming communities playing titles such as Albion Online, GTA5RP, GrandRP, Majestic RP, and Throne and Liberty.<\/p>\n Once installed, these packages quietly deploy a remote-access payload that captures live screenshots of victims\u2019 machines, exposing sensitive information directly to malicious actors.<\/p>\n According to Socket\u2019s research, the campaign splits into a structured two-stage attack chain consisting of a .NET tool downloader stage and a PyInstaller-packed Python payload.<\/p>\n Distributed as .NET command-line tools under the To ensure successful execution, the downloader resolves GitHub hosts using DNS-over-HTTPS to completely bypass the local system resolver and network DNS sinkholes. <\/p>\n Additionally, 10 of the 11 samples aggressively request User Account Control (UAC)<\/a> elevation to resync the Windows clock before fetching the primary payload.<\/p>\n All 11 downloaders share identical hardcoded AWS-style key material and the same process mutex GUID, tying the entire infrastructure to a single toolchain. <\/p>\n The downloader passes these cloud credentials to the child payload as environment variables, allowing the malware\u2019s cloud storage engine to configure itself without embedding secrets directly within the secondary executable. <\/p>\n Similar supply chain campaigns show that threat actors increasingly leverage credential-harvesting malware to target open-source repository environments.<\/p>\n Once running on the compromised machine, The telemetry gathered by Socket research includes<\/a> hardware fingerprints, system hostnames, GPU and CPU models, IP-based geolocation, and OS activation status. The malware checks a remote HWID\/UUID ban-list on every launch, giving the operator a centralized server-side kill switch to manage infected endpoints.<\/p>\n Three of the payloads, specifically those targeting Albion, Calculator, and Throne, ship as direct Python bytecode. They expose a large-scale game automation framework with integrated Telegram bot commands.<\/p>\n Any external user completing the These stealth administrative exposures mirror modern remote execution exploits that target corporate and consumer endpoints alike.<\/p>\n Because the screenshot routines record whatever is active on the display, any open password managers, browser sessions, crypto wallets, or private messages visible at capture time are immediately exfiltrated to the attacker\u2019s Telegram interface. <\/p>\n The eight PyArmor-protected payloads add an automated fallback that reroutes blocked Google Sheets traffic through a hardcoded authenticated proxy, undermining basic network-level indicator blocking. <\/p>\n Furthermore, the direct-bytecode variants modify Windows Installer registry policy on exit and can trigger a destructive cleanup routine that recursively wipes subdirectories in the application\u2019s working folder.<\/p>\n Multiple tracking indicators, including Russian-language console output, Russian build comments, targeting of Russian-speaking roleplay game communities, and a storefront ( Socket has reported the packages to the NuGet security team for immediate remediation.<\/p>\n Attackers Move in Seconds. Defenses Take Hours! Blackpoint Built the Answer \u2013 <\/strong>Attend a Free Webinar<\/strong><\/a> on AI SOC Agent to contain a live attack.<\/strong><\/p>\n The post Gamers Download Fake Cheats and Hand Attackers a Live Remote Control of Their Windows PCs<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nDotnetTool<\/code> package type, each package acts as a first-stage component that fetches and runs a second-stage Windows executable named pepesoft.exe<\/code>. <\/p>\n![\"Attack](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiYbiGxVnzw8q1DaC7Iu0vGzeHWCkeZ5xPXzQIHI_xjbHHjhNyLOl6WDX_edNdph_0ulvctNqtHognDMEXOv1WwpmO5-WOfSKstFtna3uombEsTRI5ZZ_3HQjCTmcbzR1b2joYWqB4ipsnEGF81FC08JQOyuAPH2KbpnlJkoYOGQNa1cN33Axa4jl2zYp0\/s1600\/63e1e25e666fa2e5fe34219ab735cd0cf0b3a3a6-2048x1117.webp?resize=2048%2C1117&ssl=1\")
![\"Operator](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi0N2ae3y_5kD9ncihu5V6aTIBloXvGts6_tQ0hA0gAnl-r_2GZNtYoUEBNbJIhSbkfcIfsU74Xk6Yk41R-vmGNEnNtEDql16CkaZT6e9Xwr6zFN7geBbkbMZ_8CMontNeO6AYQaDEyXwcAEStiVdcOYXm6lWh_Dej1j2USC6KlDdMol-9OiEUHxMNteXs\/s1600\/2170b2cfe2fd6f323ede0ab8745d0aced5b5df33-2000x2049.webp?resize=2000%2C2049&ssl=1\")
pepesoft.exe<\/code> authenticates to Google Sheets to compile a persistent log of victim data. <\/p>\n\/start<\/code> command in the attacker\u2019s chat can trigger an unauthorized screenshot capture of the active game window, the full desktop, or targeted program processes. <\/p>\n![\"Socket\u2019s](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEikknATmywvu5OZB6RgvmkX6wVh1PCW78_VauYcyG28-hLAvJ3C06V3Atxccc-BSbh7-znnTOKCi6lAH1T-YruboMJD-X8jTw338VRExwp5rodh9eYwV3u44OBj0XFt658Nm7gTsFZofn6zAL9OWh6NJ4omRHy5wB3lzmzwt3SN_KRbugEFeTTr2Qxl3o8\/s1600\/18887f9158bc827b1867286a5edcd25bb0eabafe-1146x1116.webp?resize=1146%2C1116&ssl=1\")
amazing-x-x@7.7.8<\/code>\u00a0as known malware<\/em> (Image Source: Socket)<\/figcaption><\/figure>\n\n\n
\n Target Application Variant<\/strong><\/td>\n Obfuscation \/ Payload Style<\/strong><\/td>\n Primary Ingestion Target<\/strong><\/td>\n Unique Behavioral Trait<\/strong><\/td>\n<\/tr>\n<\/thead>\n\n \n Albion, Calculator, Throne<\/strong><\/td>\n Direct Python Bytecode<\/td>\n Telegram command handlers<\/td>\n Exposes unauthenticated \/start<\/code> remote screenshot loops<\/td>\n<\/tr>\n\n Amazing RP, GTA5RP, Lineage 2, RMRP<\/strong><\/td>\n PyArmor-Protected Binary<\/td>\n Authenticated proxy fallback<\/td>\n Re-routes blocked Google Sheets traffic via proxy layers<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n bots.pepesoft[.]ru<\/code>) advertising \u201cbots without bans\u201d strongly point to a Russian-speaking operator running a commercial paid-cheat service.<\/p>\n