Loading story…
Researchers have uncovered a series of malicious packages published to the NuGet open-source platform, specifically targeting cryptocurrency users and developers. These packages, such as the impersonation of the legitimate Nethereum library, were designed to steal crypto funds by redirecting transactions to attacker-controlled wallets and exfiltrating sensitive secrets. The campaign, active since at least July 2025, involved at least 14 packages that mimicked legitimate crypto-related tools, using techniques like homoglyphs and typosquatting to evade detection and appear trustworthy. The malicious code was carefully hidden within copied legitimate functionality, making analysis and detection more challenging for defenders.
The attackers leveraged multiple open-source ecosystems in their broader campaign, but the recent focus on NuGet marks a significant escalation. The packages were published by various authors over several months, and their malicious intent included both direct theft of funds and the collection of credentials for later exploitation. Security researchers emphasize the sophistication of these attacks, highlighting the need for increased vigilance when using third-party packages in development environments, especially those related to cryptocurrency operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
As part of the campaign, the threat actors boosted package credibility through version bumping and artificially inflated download counts, including more than 10 million fake downloads tied to poisoned dependencies such as Nethereum.All. These tactics increased the likelihood that developers would install the malicious packages.
By mid-December 2025, public reporting disclosed the long-running NuGet campaign, its use of homoglyphs and typosquatting, and the package categories involved, including wallet stealers, crypto-funds redirectors, and Google Ads OAuth stealers. ReversingLabs also published indicators of compromise to help defenders identify affected packages and downstream risk.
During 2024 and 2025, ReversingLabs researchers identified 14 malicious NuGet packages impersonating legitimate crypto-related tools. The packages were used to steal wallet secrets, redirect crypto funds, and compromise Google Ads OAuth credentials while evading detection through delayed or conditional execution.
A supply-chain campaign using typosquatting and homoglyph package names began operating on NuGet, targeting developers who used crypto-related .NET packages. The activity ultimately persisted for about five years and focused on stealing wallet data and other secrets from victims who installed the packages.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcereversinglabs.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at Socket identified a malicious NuGet package named 'Netherеum.All' that impersonated the legitimate Nethereum library by using a Cyrillic 'e' in its name, making it visually indistinguishable from the original. The package was designed to exfiltrate sensitive wallet information, including mnemonics, private keys, keystore JSON, and signed transaction data, by sending it to a command and control server themed after Solana. The threat actor leveraged the popularity of Nethereum, a widely used .NET library for Ethereum, to target developers and users in the cryptocurrency ecosystem. The malicious package was first published on October 16, 2025, and was reported to the NuGet security team two days later, leading to its removal and the suspension of the associated publisher account. Further investigation linked this campaign to a previous typosquat, 'NethereumNet', which used similar exfiltration techniques and was also removed by NuGet. The attack highlights the risks of homoglyph abuse in package registries and the ongoing threat of supply chain attacks targeting cryptocurrency-related software.
Jul 12, 2026
Security researchers have uncovered multiple campaigns involving malicious npm packages designed to steal developer credentials and sensitive information from Windows, macOS, and Linux systems. In one operation, ten typosquatted packages impersonated popular libraries such as TypeScript, discord.js, ethers.js, and others, using sophisticated obfuscation, fake CAPTCHA prompts, and postinstall hooks to deploy an information stealer that harvested credentials from system keyrings, browsers, and authentication services. The malware executed in a new terminal window to evade detection and sent stolen data, including IP addresses, to external servers. Another large-scale campaign, dubbed 'PhantomRaven,' involved 126 npm packages and over 86,000 downloads, targeting authentication tokens, CI/CD secrets, and GitHub credentials. These packages leveraged remote dynamic dependencies to fetch and execute payloads during installation, profiling infected devices and exfiltrating secrets for potential supply chain attacks. The attackers employed techniques such as slopsquatting, where AI-generated package recommendations led developers to install non-existent, malicious packages. Some packages impersonated tools from GitLab and Apache, and many remained available on npm at the time of reporting. The campaigns highlight the ongoing risks in the npm ecosystem, with attackers exploiting both user trust and platform weaknesses to compromise developer environments and CI/CD pipelines. Security experts warn that the theft of tokens and credentials could enable further attacks, including the introduction of malicious code into legitimate projects and broader supply chain compromises.
Jun 29, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026