GCVE-110-OSM-2026-210

Malicious NuGet package impersonating the legitimate Chinese AntdUI library. Wraps an infostealer protected with .NET Reactor and triggered via module initializer; exfiltrates browser, wallet, SSH and Steam credentials to dns-providersa2[.]com. Malicious payload found in: module initializer (JIT hook into CLR) Obfuscation: .NET Reactor Necrobit + RSA-1024 Anti-Tamper (RSA modulus prefix zlUkMywGKDNbeJxH; family ties to Lumma/Quantum/AgentRacoon/ArrowRAT) C2 beacon: https://dns-providersa2[.]com/check C2 exfil: https://dns-providersa2[.]com/upload Staging file: C:\ProgramData\Microsoft OneDrive\keys.dat SHA256: 596c453c9dbb7240f1ce05cc025496524ce7c538c23a9b2171174bf32b5691a1 Behavior: Browser credential harvesting, crypto wallet extension/desktop wallet theft, SSH keys, Outlook profiles, Steam credentials, document theft from Documents/Desktop/Downloads, architecture-matched DLL injection for persistence, HTTPS exfil with random X-[abc] headers.