Fallout in dotnet, Aug 10 – Aug 16

What we caught this week while monitoring over 167,302,422 artifacts across 46 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

FRIDAY

Fri Aug 14 · 1 catch · 0 waves · 1 single
micro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/anti-staticmicro-behaviors/datamicro-behaviors/cryptomicro-behaviors/fsobjectives/evasionobjectivesmicro-behaviors/process+3 42d
Shoreless.Framework 1.0.0.63 dotnet 6,134 installs 42 days ago

Obfuscated process interference and evasion

hidden/executionllm/override

WEDNESDAY

Wed Aug 12 · 3 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/datamicro-behaviors/processmetadata/packagemetadata/buildobjectivesobjectives/evasionmetadata/binarymetadata 44d
dotnet-tool-tofu 0.0.6 dotnet 8,581 installs 44 days ago

Future-dated masquerading process launcher

masquerade/binary
well-knownwell-known/appmicro-behaviors/cryptomicro-behaviorsmetadata/binarymetadataobjectives/anti-analysisobjectives/evasionobjectives/anti-staticobjectivesobjectives/command-and-control+8 44d
BlackStarAPS 2.3.3 dotnet 4,857 installs 44 days ago

obfuscated, anti-analysis, memory injection

staging/embeddedobfuscation/imports
micro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadatamicro-behaviors/datamicro-behaviors/processmicro-behaviors/osmicro-behaviors/fsmetadata/packageobjectives/anti-staticobjectives+1 44d
LuBan.Common 2026.8.12.1 dotnet 9,623 installs 44 days ago

encrypted resource stager, reflection emit

pack/runtimereflection/invoke

TUESDAY

Tue Aug 11 · 3 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsmalware/librarymalwareobjectives/anti-staticmicro-behaviors/cryptomicro-behaviors/dataobjectivesobjectives/evasionmetadata/binarymetadata+14 45d
Exanite.Engine.BuildSyste…-dev-nuget-publishing.6682 dotnet 45 days ago

Future-dated masquerading process launcher

masquerade/binary
micro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/command-and-controlthird_partymicro-behaviors/cryptomicro-behaviors/datamicro-behaviors/processobjectives/anti-staticobjectives+6 45d
Laboratory 1.5.3 dotnet 16,853 installs 45 days ago

Obfuscated, unsigned, reflective loader

reflection/invokepayload/resource
micro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/command-and-controlobjectives/supply-chainmicro-behaviors/cryptomicro-behaviors/datamicro-behaviors/processobjectives/anti-staticobjectives+7 45d
Laboratory 1.5.1 dotnet 16,853 installs 45 days ago

Obfuscated, unsigned, reflective, crypto, HTTP

reflection/invokepayload/resource

MONDAY

Mon Aug 10 · 1 catch · 0 waves · 1 single
micro-behaviors/communicationsmicro-behaviorsmalwaremalware/appmicro-behaviors/datamicro-behaviors/fsmicro-behaviors/osobjectives/evasionobjectivesmetadata/binarymetadata+11 46d
XafLogicExplainer.Cli 0.11.0 dotnet 46 days ago

Future-dated masquerading process launcher

masquerade/binary
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories