ThreatsDay: Game Cheat Spyware, Spirals Ransomware, Chrome Sync Stalking

Weekly Threat Roundup

A recurring pattern runs through this week's threat landscape: things that look familiar enough to click, install, or trust. A known package namespace. A browser sync setting you forgot to check. An installer that runs its own logic quietly in the background. Here are the three stories driving the most signal this week.

1. Game Cheat Spyware: NuGet Supply Chain Poisoned

Researchers discovered 11 malicious NuGet packages disguised as .NET game utilities, bots, and "panels" — the type of tooling developers working on game integrations or automation would regularly search for and install.

Each package acts as a first-stage downloader, fetching a second-stage Python payload named pepesoft.exe from two delivery paths:

The BitTorrent fallback is significant — it ensures delivery continues even if the GitHub and Hugging Face accounts are taken down, and it complicates takedown coordination across multiple platforms.

What to do: Audit NuGet dependencies in any .NET projects touching game utilities or automation tooling. Search for pepesoft.exe in process history. Block outbound connections to domains under pepegit666's GitHub and Hugging Face accounts.

2. Spirals Ransomware: Network-Wide in Under 24 Hours

Broadcom's Symantec and Carbon Black Threat Hunter teams disclosed a previously undocumented Rust-based ransomware family called Spirals, attributing a June 2026 attack on a South Asian IT services company. The timeline is striking:

The ransom note threatens to publish stolen data after 6 days and directs victims to a Tor portal — a standard double-extortion model, but the speed of execution is exceptional even by modern ransomware standards.

The Rust implementation is consistent with a trend toward memory-safe ransomware that resists traditional analysis tooling and antivirus signatures tuned for common C/C++ payloads.

What to do: Harden externally-facing IIS servers — disable unnecessary ISAPI handlers, restrict webshell upload paths, and deploy runtime protection capable of detecting anomalous child processes from w3wp.exe. Monitor for SAM hive access (reg save HKLM\SAM) outside of authorized backup windows.

3. Chrome Sync Stalking: No App Required

Certo Software documented a growing abuse pattern targeting Chrome's built-in account sync — one that requires no malware installation and leaves no persistent indicator on the victim's device.

How it works

An attacker with brief physical access to the victim's device signs Chrome into an attacker-controlled Google account with sync enabled. From that point forward, the following data is continuously mirrored to the attacker's account from all of the victim's devices (Android, iOS, Windows, Mac):

• Full browsing history
• Open and recently closed tabs
• Bookmarks
• Autofill data
• Saved passwords

Chrome provides no persistent notification when a new account is added or sync is activated, and the attacker-controlled account entry is easy to overlook in Chrome's settings.

The scale of Chrome's market share means this technique has an enormous potential victim pool, and the barrier to entry — brief unsupervised device access — is extremely low in domestic abuse or insider threat contexts.

What to do: Check Chrome's active accounts at chrome://settings/syncSetup and review which Google accounts are syncing. Remove any unrecognized accounts immediately. On managed devices, enforce sign-in policies that restrict Chrome sync to approved organizational accounts.

Additional Threats from the Roundup

Key Takeaways

The thread connecting this week's threats is trust exploitation at the edges — package registries, browser defaults, and remote management tools that security teams have broadly accepted as safe. Controls targeting these surfaces:

1. NuGet: Enable package source filtering; pin dependency versions and verify hashes
2. Ransomware speed: Assume dwell time is measured in hours, not days; tune detection for post-exploitation tooling (PsExec, reg save, AV uninstall)
3. Chrome Sync: Treat Chrome sign-in as an access control boundary; enforce managed profile policies

Sources

• The Hacker News — ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking
• Certo Software — Cyberstalkers Are Exploiting Chrome Sync to Spy on Victims

Related Reading

• Ransomware 2026: Data Extortion Replaces Encryption as Primary Lever
• Cline CLI Supply Chain Attack: OpenClaw Campaign