IAmReboot: Malicious NuGet packages exploit loophole in MSBuild integrations

ReversingLabs has identified connections between a malicious campaign that was recently discovered and reported by the firm Phylum and several hundred malicious packages published to the NuGet package manager since the beginning of August. The latest discoveries are evidence of what seems to be an ongoing and coordinated campaign.

Furthermore, ReversingLabs research shows how malicious actors are continuously improving their techniques and responding to the disruption of their campaigns. Specifically, threat actors have moved from simple downloaders executing inside install …

august campaign connections coordinated exploit integrations latest malicious malicious packages manager msbuild nuget package package manager packages phylum reversinglabs