Malicious NuGet Packages Target Browser Credentials, SSH Keys, and Crypto Wallets

This report describes a persistent supply-chain campaign where an actor publishing under the NuGet account "bmrxntfj" released five malicious packages built atop legitimate .NET libraries; the packages use a .NET module initializer and JIT hooking to deploy a second-stage infostealer (we4ftg.exe) that exfiltrates browser credentials, crypto wallet data, SSH keys, Outlook/Steam credentials, and files to a C2 infrastructure, with ~64,784 downloads and extensive IoCs provided.