WasmForge is a build wrapper that compiles existing Go-based offensive security tools (like Sliver, Chisel, and Mythic implants) into WebAssembly without modifying their source code, producing binaries that evade EDR static analysis. The system works in three stages: patching Go's stdlib for WASI compatibility, compiling to a .wasm module, and wrapping it in a custom Wazero runtime with ~80 host shim functions bridging WASI gaps for Win32 and macOS APIs. Evasion techniques include per-build randomized WASM opcode tables, custom magic bytes, harvested symbol tables from real Go projects ('ghost profiles'), and randomized PE metadata and signing identities. The tool was validated by running Sliver, Chisel, gogokatz, and goffloader on real engagements against hardened Windows and macOS endpoints. WasmForge will be open-sourced alongside a forthcoming post on compiling .NET/C# GhostPack tools to WASM via NativeAOT-LLVM.
