GCVE-110-OSM-2026-214

Malicious NuGet package impersonating the legitimate Chinese AntdUI library. Wraps an infostealer payload protected with .NET Reactor (Necrobit + RSA Anti-Tamper). Executes via module initializer before application code runs, harvesting browser credentials, cryptocurrency wallets, SSH keys, Outlook profiles, and Steam credentials, then exfiltrating to dns-providersa2[.]com. Malicious payload found in: module initializer (JIT hook into CLR) Obfuscation: .NET Reactor Necrobit encryption with RSA-1024 Anti-Tamper public key (modulus prefix: zlUkMywGKDNbeJxH) — same key family linked to Lumma/Quantum/AgentRacoon/ArrowRAT. C2 beacon: https://dns-providersa2[.]com/check C2 exfil: https://dns-providersa2[.]com/upload Staging file: C:\ProgramData\Microsoft OneDrive\keys.dat SHA256: 34e2d63b5db7e24c808711c2ca0c0a42afde97a0086d7d81609110c002d18d7c Behavior: Harvests credentials from 12 Chromium browsers + Firefox; targets 5 wallet extensions (MetaMask nkbihfbeogaeaoehlefnkodbefgpgknn, TronLink ibnejdfjmmkpcnlpebklmnkoeoihofec, Phantom bfnaelmomeimhlpmgjnjophhpkkoljpa, Trust Wallet egjidjbpglichdcondbcbdnbeeppgdph, Coinbase hnfanknocfeofbddgcijnmhnfnkdnaad) and 8 desktop wallets; steals SSH keys, Outlook profiles, Steam credentials, and documents from Documents/Desktop/Downloads. Performs architecture-matched DLL injection for persistence. Exfiltration uses HTTPS with random X-[abc] header obfuscation.