Weekly Threat Roundup
A recurring pattern runs through this week's threat landscape: things that look familiar enough to click, install, or trust. A known package namespace. A browser sync setting you forgot to check. An installer that runs its own logic quietly in the background. Here are the three stories driving the most signal this week.
1. Game Cheat Spyware: NuGet Supply Chain Poisoned
Researchers discovered 11 malicious NuGet packages disguised as .NET game utilities, bots, and "panels" — the type of tooling developers working on game integrations or automation would regularly search for and install.
Each package acts as a first-stage downloader, fetching a second-stage Python payload named pepesoft.exe from two delivery paths:
| Delivery path | Location |
|---|---|
| Primary | GitHub Releases under user pepegit666 |
| Secondary | Hugging Face paths under pepegit666 |
| Fallback | BitTorrent (dormant, for resilience) |
The BitTorrent fallback is significant — it ensures delivery continues even if the GitHub and Hugging Face accounts are taken down, and it complicates takedown coordination across multiple platforms.
What to do: Audit NuGet dependencies in any .NET projects touching game utilities or automation tooling. Search for pepesoft.exe in process history. Block outbound connections to domains under pepegit666's GitHub and Hugging Face accounts.
2. Spirals Ransomware: Network-Wide in Under 24 Hours
Broadcom's Symantec and Carbon Black Threat Hunter teams disclosed a previously undocumented Rust-based ransomware family called Spirals, attributing a June 2026 attack on a South Asian IT services company. The timeline is striking:
| Time from initial access | Action |
|---|---|
| ~0h | IIS web server compromised via ASP.NET webshell upload |
| ~3h | Persistence established, reconnaissance completed |
| ~3h | Endpoint security software uninstalled |
| ~3h | SAM hive dumped, covert remote access configured |
| ~24h | Ransomware deployed network-wide via PsExec |
The ransom note threatens to publish stolen data after 6 days and directs victims to a Tor portal — a standard double-extortion model, but the speed of execution is exceptional even by modern ransomware standards.
The Rust implementation is consistent with a trend toward memory-safe ransomware that resists traditional analysis tooling and antivirus signatures tuned for common C/C++ payloads.
What to do: Harden externally-facing IIS servers — disable unnecessary ISAPI handlers, restrict webshell upload paths, and deploy runtime protection capable of detecting anomalous child processes from w3wp.exe. Monitor for SAM hive access (reg save HKLM\SAM) outside of authorized backup windows.
3. Chrome Sync Stalking: No App Required
Certo Software documented a growing abuse pattern targeting Chrome's built-in account sync — one that requires no malware installation and leaves no persistent indicator on the victim's device.
How it works
An attacker with brief physical access to the victim's device signs Chrome into an attacker-controlled Google account with sync enabled. From that point forward, the following data is continuously mirrored to the attacker's account from all of the victim's devices (Android, iOS, Windows, Mac):
- Full browsing history
- Open and recently closed tabs
- Bookmarks
- Autofill data
- Saved passwords
Chrome provides no persistent notification when a new account is added or sync is activated, and the attacker-controlled account entry is easy to overlook in Chrome's settings.
| Stat | Value |
|---|---|
| Chrome global market share (June 2026) | 69.65% |
| BEC incidents in Germany/Benelux involving account monitoring | 81% |
The scale of Chrome's market share means this technique has an enormous potential victim pool, and the barrier to entry — brief unsupervised device access — is extremely low in domestic abuse or insider threat contexts.
What to do: Check Chrome's active accounts at chrome://settings/syncSetup and review which Google accounts are syncing. Remove any unrecognized accounts immediately. On managed devices, enforce sign-in policies that restrict Chrome sync to approved organizational accounts.
Additional Threats from the Roundup
| Threat | Summary |
|---|---|
| Jalisco | AI-powered OAuth device-code phishing toolkit; provisions fresh codes in real time to defeat time-based controls |
| OmegaLord | JavaScript credential harvester impersonating a PDF reader; collects phone numbers alongside passwords to intercept MFA |
| SeasonalInvite | Phishing campaign active since January 2026; abuses ConnectWise ScreenConnect, LogMeIn, Kaseya, and O&O Syspectr via 959 eCard-themed domains and a TDS with 2,658 gate pages |
Key Takeaways
The thread connecting this week's threats is trust exploitation at the edges — package registries, browser defaults, and remote management tools that security teams have broadly accepted as safe. Controls targeting these surfaces:
- NuGet: Enable package source filtering; pin dependency versions and verify hashes
- Ransomware speed: Assume dwell time is measured in hours, not days; tune detection for post-exploitation tooling (PsExec,
reg save, AV uninstall) - Chrome Sync: Treat Chrome sign-in as an access control boundary; enforce managed profile policies
Sources
- The Hacker News — ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking
- Certo Software — Cyberstalkers Are Exploiting Chrome Sync to Spy on Victims