Tag: nuget

3 Attack Reports | 0 Vulnerabilities

Attack reports

5 Malicious NuGet Packages Impersonate Chinese UI Libraries to Distribute Crypto Wallet and Credential Stealer

Five malicious NuGet packages published under account bmrxntfj impersonate Chinese .NET libraries to deploy an infostealer targeting browser credentials, cryptocurrency wallets, SSH keys, and local files. The packages typosquat legitimate Chinese UI and infrastructure libraries, grafting .NET React…
lumma
supply chain attack
nuget
browser credential theft
2026-05-07
arrowrat
quantum
Published: May 7, 2026
Downloadable IOCs: 9

Four Malicious NuGet Packages Target ASP.NET Developers With JIT Hooking and Credential Exfiltration

A NuGet supply chain attack involving four malicious packages targeting ASP.NET web application developers has been discovered. The campaign deploys a multi-stage payload where NCryptYo acts as a dropper, establishing a local proxy, while companion packages exfiltrate ASP.NET Identity data and acce…
backdoor
obfuscation
typosquatting
supply-chain-attack
asp.net
nuget
2026-02-24
credential-exfiltration
domoauth2_
iraoauth2.0
jit-manipulation
ncryptyo
simplewriter_
Published: February 24, 2026
Downloadable IOCs: 4

NuGet malware targets crypto wallets, OAuth tokens

ReversingLabs discovered malicious packages on NuGet targeting the crypto ecosystem. The campaign, starting in July 2025, involved 14 packages impersonating legitimate crypto-related tools. The malware aimed to steal crypto funds by redirecting transactions or exfiltrating secrets for wallet access…
cryptocurrency
supply chain attack
oauth
homoglyphs
2025-12-17
coinbase.net.api
googleads.api
netherеum.all
nuget
version bumping
wallet stealer
Published: December 17, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports