Coordinated malicious NuGet campaign of 11 packages that impersonate game cheats, bots, and control panels for titles such as Albion Online, GTA5RP, Lineage 2, and Throne and Liberty. Published as DotnetTool packages, each is a two-stage downloader: the first-stage .NET assembly resolves GitHub hosts over DNS-over-HTTPS and fetches and executes a payload (pepesoft.exe) using embedded cloud credentials; the second-stage PyInstaller-packed Python payload reports telemetry to Google Sheets, enforces hardware-bound licensing, applies a server-side ban-list, and in three packages exposes Telegram bot handlers for remote screenshot capture. All versions of each package are malicious.