Poisoned Pipeline / Incidents / AS57
Eleven NuGet packages posing as game cheats
On 15 September 2026 Socket published eleven malicious NuGet packages
posing as game-cheat / trainer tools (Fortnite, Valorant, Roblox, GTA,
CS2, Minecraft and similar). Combined they had been downloaded more than
1.8 million times. Several used a .NET AssemblyResolve handler so the
payload only ran when a missing dependency was requested; others dropped
a second-stage executable from a Discord CDN URL. Payloads included
infostealers, a clipper, and a reverse shell. Not a hijack of a trusted
library — brandjacking of game titles on a public registry.
Mapped techniques
- T0109 Publish malicious artifact
- T0110 Advertise malicious artifact
- T0136 Brandjacking
- T0159 Malicious artifact execution
supply-chain malicious nuget publishes
Eleven first-party NuGet packages under cheat/trainer names.
Game-title brandjacking to attract search traffic.
Fortnite, Valorant, Roblox, GTA, CS2, Minecraft names.
AssemblyResolve delayed load or Discord-CDN second stage.