WasmForge lets Red Teams ship GhostPack C# tools as undetectable WebAssembly binaries
Praetorian open‑sourced WasmForge, a toolchain that compiles C# offensive utilities like Rubeus and Seatbelt to WebAssembly using .NET NativeAOT‑WASI. The resulting binaries run outside the CLR, sidestepping AMSI, ETW and YARA signatures that flag traditional GhostPack tools, giving attackers a stealthier delivery method.