Loading story…
A malicious NuGet package named Tracer.Fody.NLog was discovered impersonating the legitimate .NET tracing library Tracer.Fody, using typosquatting and homoglyph techniques to deceive developers. Published in 2020 under the alias csnemess—a near match to the real maintainer's handle—the package successfully evaded detection for over five years, accumulating approximately 2,000 downloads. The malware embedded within the package specifically targets Stratis cryptocurrency wallets, lying dormant until triggered by certain conditions, and then silently exfiltrating wallet data and passwords to attacker-controlled infrastructure in Russia.
The attack leverages a common coding pattern by hooking into the Guard.NotNull<T> helper method, activating when an object with a WalletPassword property is processed. The malicious code scans the default Stratis wallet directory, reads *.wallet.json files, and transmits sensitive information without alerting the user or generating logs. The sophisticated use of lookalike package names, maintainer aliases, and Unicode homoglyphs in code identifiers made the threat difficult to detect during manual reviews, highlighting the persistent risks of supply chain attacks in open-source ecosystems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
At the time of public reporting, the rogue Tracer.Fody.NLog package remained accessible on the NuGet repository. Researchers warned that similar typosquatting supply-chain attacks could target other widely used .NET libraries.
By mid-December 2025, security researchers identified that Tracer.Fody.NLog was not a legitimate tracing component but a cryptocurrency wallet stealer targeting Stratis wallets on Windows. Analysis showed it exfiltrated wallet files and passwords to infrastructure in Russia while using silent exception handling and hidden helper methods to evade detection.
In December 2023, another malicious NuGet package, Cleary.AsyncExtensions, was linked to the same Russian IP address and threat infrastructure. That package also exfiltrated sensitive cryptocurrency wallet information, indicating a broader campaign by the same actor.
Over the following years, the malicious package stayed available on the NuGet repository and was downloaded roughly 2,000 times. Its long dwell time increased the likelihood of developer adoption and downstream exposure in .NET projects.
A threat actor published the rogue NuGet package Tracer.Fody.NLog in February 2020, typosquatting the legitimate Tracer.Fody library and impersonating its maintainer. The package used homoglyphs and disguised itself as a benign .NET tracing integration while embedding wallet-stealing functionality.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have uncovered a series of malicious packages published to the NuGet open-source platform, specifically targeting cryptocurrency users and developers. These packages, such as the impersonation of the legitimate `Nethereum` library, were designed to steal crypto funds by redirecting transactions to attacker-controlled wallets and exfiltrating sensitive secrets. The campaign, active since at least July 2025, involved at least 14 packages that mimicked legitimate crypto-related tools, using techniques like homoglyphs and typosquatting to evade detection and appear trustworthy. The malicious code was carefully hidden within copied legitimate functionality, making analysis and detection more challenging for defenders. The attackers leveraged multiple open-source ecosystems in their broader campaign, but the recent focus on NuGet marks a significant escalation. The packages were published by various authors over several months, and their malicious intent included both direct theft of funds and the collection of credentials for later exploitation. Security researchers emphasize the sophistication of these attacks, highlighting the need for increased vigilance when using third-party packages in development environments, especially those related to cryptocurrency operations.
Jun 29, 2026
Security researchers at Socket identified a malicious NuGet package named 'Netherеum.All' that impersonated the legitimate Nethereum library by using a Cyrillic 'e' in its name, making it visually indistinguishable from the original. The package was designed to exfiltrate sensitive wallet information, including mnemonics, private keys, keystore JSON, and signed transaction data, by sending it to a command and control server themed after Solana. The threat actor leveraged the popularity of Nethereum, a widely used .NET library for Ethereum, to target developers and users in the cryptocurrency ecosystem. The malicious package was first published on October 16, 2025, and was reported to the NuGet security team two days later, leading to its removal and the suspension of the associated publisher account. Further investigation linked this campaign to a previous typosquat, 'NethereumNet', which used similar exfiltration techniques and was also removed by NuGet. The attack highlights the risks of homoglyph abuse in package registries and the ongoing threat of supply chain attacks targeting cryptocurrency-related software.
Jul 12, 2026
Two malicious Rust packages, named 'faster_log' and 'async_println', were discovered on the official Crates.io repository, where they were designed to steal private keys from cryptocurrency wallets, specifically targeting Solana and Ethereum users. These packages were downloaded nearly 8,500 times before their removal, with 'faster_log' accounting for 7,200 downloads and 'async_println' for 1,200. The malicious crates impersonated the legitimate 'fast_log' crate by copying its README file, repository metadata, and maintaining the original logging functionality to avoid suspicion among developers. The attackers embedded a payload within the crates that, upon execution, scanned the victim's environment and project source files for sensitive information, including hex strings resembling Ethereum private keys, Base58 strings similar to Solana keys or addresses, and bracketed byte arrays that could contain keys or seeds. When such data was found, it was bundled with the file path and line number and exfiltrated to a hardcoded Cloudflare Worker URL, which was confirmed to be live and accepting POST requests during the investigation. The malicious activity was discovered by researchers at the code security company Socket, who promptly reported it to Crates.io. In response, Crates.io removed both packages and suspended the publishing accounts, 'rustguruman' and 'dumbnbased', on September 24th. The incident highlights the risks associated with open-source software supply chains, where attackers can leverage trusted repositories to distribute malware to unsuspecting developers. The malicious crates did not have any dependent downstream crates, which may have limited the spread of the compromise. The attack demonstrates the sophistication of threat actors in mimicking legitimate projects to evade detection and the importance of vigilant monitoring of package repositories. The use of a legitimate logging functionality within the malicious crates further reduced suspicion, allowing the packages to remain undetected for several months. The exfiltration endpoint used by the attackers was not an official Solana RPC endpoint, indicating a deliberate attempt to disguise the data theft operation. This supply chain attack underscores the need for developers to verify the authenticity of third-party packages and for repository maintainers to implement robust security controls. The incident also serves as a warning to the broader cryptocurrency and developer communities about the ongoing threat of targeted attacks seeking to compromise digital assets through software dependencies. Security researchers continue to monitor for similar threats and advise immediate removal of the affected packages from any projects.
Jun 29, 2026