GCVE-110-OSM-2026-212

Malicious NuGet package containing functional Chinese enterprise data-service library code with an embedded infostealer. Module initializer triggers payload at load time, exfiltrating credentials and crypto wallet artifacts to dns-providersa2[.]com. Malicious payload found in: module initializer (JIT hook into CLR) Obfuscation: .NET Reactor Necrobit + RSA-1024 Anti-Tamper C2 beacon: https://dns-providersa2[.]com/check C2 exfil: https://dns-providersa2[.]com/upload Staging file: C:\ProgramData\Microsoft OneDrive\keys.dat SHA256: b8fa1b2fade45304c003909e375d2519ea447b498b7d93fe7c50db014d30f4fa Behavior: Browser/wallet/SSH/Steam/Outlook credential theft, document exfil, architecture-matched DLL injection for persistence, HTTPS exfil with obfuscated headers.