Trojanized NuGet Fork Rigged to Cheat Online Betting Platform

Cybersecurity researchers at JFrog have uncovered an unusually targeted supply chain attack on the NuGet package registry: a trojanized fork of the popular Newtonsoft.Json library designed not to steal credentials, but to manipulate live game outcomes on Digitain, a real-money online betting platform. The malicious package, published under the typosquatted name "Newtonsoftt.Json.Net," was uploaded in seven versions — 11.0.4 through 11.0.11 — and downloaded roughly 1,200 times before being unlisted by its owner, "MagicalPuff96." While the artifacts remain accessible from the registry, they no longer appear in NuGet search results.

What makes this campaign stand out is its precision. Developers who install the package by typo receive a fully functional Newtonsoft.Json build, and the malicious behavior only triggers after JsonConvert.DefaultSettings is initialized on systems that expose Digitain's specific FG-Crash backend method. The backdoor hooks into the DefaultSettings property setter, injecting attacker-controlled code that introduces a randomized delay to evade detection before patching a single target method. Rigged round results are then exfiltrated to a hard-coded endpoint at 185.126.237[.]64:5341, disguised as telemetry data using the header "X-Seq-ApiKey: theperfectheist2025."

JFrog's analysis traced the package across three generations published between August 13 and October 10, 2025, revealing an attacker who iteratively hardened the payload. Gen-1 functioned as a local-only proof of concept, Gen-2 added exfiltration concealed behind reflection and ConfuserEx obfuscation, and Gen-3 stabilized the exfiltration channel — with version 11.0.11 left completely unobfuscated, suggesting an accidental clean build. Critically, the package metadata leaks an internal Digitain repository URL across all seven versions, indicating the author had direct access to FG-Crash's source code. Organizations should audit their NuGet dependencies for unauthorized forks and verify package integrity. Security teams can run a quick DNS leak test to check for suspicious outbound connections, use a WHOIS lookup to investigate the hard-coded exfiltration IP, and perform a broader privacy checkup to identify exposed services that could be similarly targeted.