Phylum Discovers SeroXen RAT in Typosquatted NuGet Package

On October 6, 2023, Phylum’s automated risk detection platform alerted us to a suspicious publication on NuGet. After working through several layers of obfuscation we ultimately discovered that this package was delivering SeroXen RAT.

The package in question is Pathoschild.Stardew.Mod.Build.Config published by a

automated build config detection mod nuget obfuscation october package phylum platform question rat research risk seroxen ultimately working