{"id":16986,"date":"2026-07-22T22:55:31","date_gmt":"2026-07-22T22:55:31","guid":{"rendered":"https:\/\/techtrendfeed.com\/?p=16986"},"modified":"2026-07-22T22:55:31","modified_gmt":"2026-07-22T22:55:31","slug":"malicious-nuget-typosquat-targets-digitain-betting-platform-and-rigs-sport-outcomes","status":"publish","type":"post","link":"https:\/\/techtrendfeed.com\/?p=16986","title":{"rendered":"Malicious NuGet Typosquat Targets Digitain Betting Platform and Rigs Sport Outcomes"},"content":{"rendered":"


\n<\/p>\n

\n

JFrog Safety Analysis has disclosed a precision supply-chain assault by which a typosquatted NuGet bundle, Newtonsoftt.Json.Internet<\/code>, impersonated the ever-present Newtonsoft.Json<\/code> library whereas secretly rigging recreation outcomes at on-line betting operator Digitain. <\/p>\n

Not like typical info-stealers that harvest credentials indiscriminately, this trojan capabilities as a completely operational JSON library for each host besides its single meant goal.<\/p>\n

Malicious NuGet Typosquat Targets Digitain Betting Platform<\/strong><\/h2>\n

The malicious bundle\u2019s .nuspec<\/code> metadata cast the identification of James Newton-King, pointed on to the official Json.NET challenge URL, and used a plausible-looking 11.0.x model scheme. It differed from the real library by solely a doubled \u201ct\u201d and a .Internet<\/code> suffix. <\/p>\n

Underneath lib\/net8.0\/<\/code>, it shipped a trojanized fork of Newtonsoft.Json<\/code> 13.0.3 alongside a payload DLL and the official HarmonyLib<\/code> runtime-patching library, all designed to auto-load into host processes.<\/p>\n

\"Package
Package deal search outcome web page. (Picture Supply: jfrog.com)<\/figcaption><\/figure>\n
\"Unlisted
Unlisted bundle particulars web page (Picture Supply: jfrog.com)<\/figcaption><\/figure>\n

Crucially, the bundle\u2019s .nuspec<\/code> file repeatedly leaked an inside TFS repository URL belonging to Digitain\u2019s \u201cBetOnGames \/ FG-Crash\u201d challenge\u2014successfully naming the goal seven instances throughout seven revealed variations. <\/p>\n

This diploma of specificity highlights how menace actors leverage provide chain assaults<\/a> to execute surgical company fraud somewhat than opportunistic information theft.<\/p>\n

The trojan prompts solely when a number software assigns JsonConvert.DefaultSettings<\/code>, silently swapping the contract resolver whereas arming a Concord patch on a delayed timer. Within the newest era, this delay is about to 10 minutes, making certain activation happens lengthy after software startup when diagnostic logs seem clear.<\/p>\n

\"Multi-generation
Multi-generation assault circulation chart (Picture Supply: jfrog.com)<\/figcaption><\/figure>\n

As soon as triggered, the payload patches Digitain.FG.SharedCrash.GameLogic.SharedCrashRules.GenerateGameResult<\/code>, manipulating the crash-game coefficient utilizing schedules keyed thus far, time, and a particular profile for the 22:00 UTC window. The rigging is bounded to a hard and fast variety of rounds earlier than the trojan unpatches itself to keep away from ongoing detection.<\/p>\n

The attacker iterated throughout seven bundle variations revealed between August and October 2025. The marketing campaign progressed from a local-only proof of idea to an obfuscated exfiltration channel, and eventually to an unobfuscated manufacturing construct:<\/p>\n

\n\n\n\n\n\n\n\n
Era<\/strong><\/td>\nVariations Printed<\/strong><\/td>\nCore Payload Functionality<\/strong><\/td>\nUtilized Obfuscation<\/strong><\/td>\n<\/tr>\n<\/thead>\n
Gen-1<\/strong><\/td>\n11.0.7, 11.0.8<\/td>\nConsole-only rigging, no networking calls<\/td>\nDotfuscator<\/td>\n<\/tr>\n
Gen-2<\/strong><\/td>\n11.0.4, 11.0.5, 11.0.9<\/td>\nReflection-based exfiltration pipeline<\/td>\nConfuserEx (heavy)<\/td>\n<\/tr>\n
Gen-3<\/strong><\/td>\n11.0.10, 11.0.11<\/td>\nDirect HTTP postfix exfiltration to C2<\/td>\nGentle to none<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Gen-3 exfiltrated rigged outcomes to a hardcoded command-and-control server disguised as a Seq structured-logging endpoint, utilizing the header X-Seq-ApiKey: theperfectheist2025<\/code> to mix malicious visitors with regular software telemetry.<\/p>\n

\"Trojanized
Trojanized bundle execution circulation (Picture Supply: jfrog.com)<\/figcaption><\/figure>\n

JFrog disclosed the malicious bundle<\/a> to Digitain on July 7, 2026, and the corporate confirmed on July 9 that it was already conscious of the problem and had resolved it.<\/p>\n

Though the bundle was unlisted from NuGet search after October 2025, its artifacts remained downloadable. This persistence highlights the continued malicious bundle dangers<\/a> throughout open-source ecosystems.<\/p>\n

Key Defensive Actions:<\/strong><\/h4>\n