NuGet typosquat targets Digitain game results

A sophisticated NuGet typosquat package has been discovered by JFrog that deviates from typical information-stealing malware by actively rigging live game results on the Digitain platform. The malicious package, named "Newtonsoftt.Json.Net," masqueraded as a legitimate library and was downloaded approximately 1,200 times before being unlisted by its owner. This discovery highlights a new tactic in supply chain attacks, with further coverage provided by The Hacker News.

The trojanized package, which mimicked the popular Newtonsoft.Json library, published seven versions between August 13 and October 10, 2025. While appearing to function normally for most users, it specifically targeted Digitain's FG-Crash betting game. Upon initialization of JsonConvert.DefaultSettings, a randomized delay was introduced to evade detection before rigging round results and exfiltrating them to an attacker-controlled server at 185.126.237.64:5341. The progression of the malware across three generations showed increasing obfuscation, rigging strategies, and exfiltration stabilization. Notably, the package metadata leaked an internal Digitain repository URL, suggesting the attacker had prior access to the source code.

The attack's effectiveness lies in its targeted nature; only systems running Digitain's specific backend methods were affected, leaving other consumers unaware of the malware. Developers are advised to remove the package, block the C2 address, and pin to a known-good version. Digitain has acknowledged the issue and stated it has taken corrective actions.

Source: The Hacker News