Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library
Cybersecurity researchers have found a NuGet typosquat that is intended to manipulate live game outcomes on Digitain, in contrast to the traditional information-stealing malware disseminated via package registries.
"Newtonsoftt.Json.Net," the package, poses as Newtonsoft.It is a trojanized fork of the JSON library. The NuGet repository now has seven versions of the package: 11.0.4, 11.0.5, 11.0.7, 11.0.8, 11.0.9, 11.0.10, and 11.0.11. Approximately 1,200 downloads of the software have been made thus far.
MagicalPuff96, the package's owner, has unlisted it, therefore a NuGet search will not turn it up. The artifacts can still be downloaded from the registry, though.
According to JFrog, the malware manipulates the online betting site Digitain. In subsequent iterations, it uses the ...