Fake Nethereum NuGet Package Used Homoglyph Trick to Steal Crypto Wallet Keys
Researchers studying cybersecurity have discovered a new supply chain attack that uses malicious typosquats of Nethereum, a well-known Ethereum.NET integration platform, to target the NuGet package management and steal the cryptocurrency wallet keys of its victims.
Security firm Socket has discovered that the package Nethereum.All contains the ability to decode a command-and-control (C2) endpoint and exfiltrate private keys, keystore data, and mnemonic phrases.
On October 16, 2025, a person going by the moniker "nethereumgroup" uploaded the library. Four days later, it was removed from NuGet due to a violation of the service's Terms of Use.
The NuGet package is noteworthy for tricking unwary developers into downloading it by substituting the Cyrillic homoglyph read more about Fak...