Precision Supply-Chain Attack Targets Online Betting Platform: A Closer Look at the Typosquatted NuGet Package Incident
In a recent revelation, JFrog Security Research has reported a sophisticated supply-chain attack involving a typosquatted NuGet package, named Newtonsoftt.Json.Net, which maliciously mimicked the highly-regarded Newtonsoft.Json library. This attack specifically targeted the online betting operator Digitain, manipulating game outcomes to favor fraudulent gains.
Unlike conventional malware that indiscriminately gathers sensitive credentials, this particular trojan operates in a more targeted manner. It functions as a legitimate JSON library for all systems, except for its intended victim, Digitain. This subtly deceptive behavior allows the trojan to remain concealed within the infrastructure, evading standard detection mechanisms.
NuGet Typosquat: A Strategic Attack on Digitain
The malicious package was designed with a fraudulent .nuspec metadata file. This file not only forged the identity of a notable figure, James Newton-King, associated with the genuine Json.NET project, but also directed users to the legitimate project’s URL, thereby enhancing its credibility. The versioning scheme used was plausible, following a typical 11.0.x format but deviating slightly by introducing an extra “t” and appending a .Net suffix.
Under the directory lib/net8.0/, the package contained a trojanized version of Newtonsoft.Json 13.0.3, accompanied by a malicious payload DLL and the authentic HarmonyLib runtime-patching library. These components were designed to autoload into any host processes, marking the stage for a targeted attack.
Notably alarming was the internal TFS repository URL, linked to Digitain’s "BetOnGames / FG-Crash" project, which persisted in the package’s .nuspec file. This revelation was made seven times over the course of several published versions, underscoring the meticulous planning by the attackers. Such specificity reveals an alarming trend where malicious entities exploit supply chain vulnerabilities to conduct corporate fraud rather than mere opportunistic data theft.
Trigger Mechanism and Payload Activation
The trojan became active only when a host application assigned the JsonConvert.DefaultSettings method. This allowed it to silently alter the contract resolver while simultaneously arming a Harmony patch, set to trigger on a delayed timer. The most recent iteration of this attack introduced a ten-minute delay, ensuring that activation occurred well after application startup and diagnostic logs appeared benign.
Upon triggering, the unidentified payload proceeded to patch Digitain.FG.SharedCrash.GameLogic.SharedCrashRules.GenerateGameResult. It manipulated the parameters influencing game outcomes based on specific schedules associated with date, time, and a tailored profile corresponding to the 22:00 UTC window. The malicious code was cleverly designed to limit the rigging to a fixed number of gaming rounds before subtly unpatching itself, further circumventing potential detection efforts.
Evolution of the Malicious Package Campaign
The attackers displayed a methodical approach, releasing a total of seven versions from August to October 2025. This campaign evolved from a localized proof of concept to a more intricate configuration featuring obliterated exfiltration paths, culminating in a fully-fledged and unobfuscated production build.
The first generation of the package included versions 11.0.7 and 11.0.8, characterized by console-only rigging with no networking capabilities. The second generation added reflection-based exfiltration features across versions 11.0.4, 11.0.5, and 11.0.9, employing substantial obfuscation techniques. The final generation, released in versions 11.0.10 and 11.0.11, allowed direct HTTP exfiltration to a command-and-control server, cleverly disguised as a standard Seq structured-logging endpoint.
Communicating the Threat: JFrog’s Disclosure
JFrog Security Research disclosed the malicious package to Digitain on July 7, 2026. The betting platform confirmed two days later that it had already identified the issue and had implemented corrective measures. Despite the package being unlisted from NuGet’s searchable indexes post-October 2025, remnants of its artifacts continued to be accessible for download. This persistence serves as a stark reminder of the ongoing risks associated with malicious packages within open-source ecosystems.
Strategic Defensive Measures Against Supply Chain Attacks
In light of this incident, several key defensive actions have been recommended for organizations to mitigate their risk:
- Remove Dependencies: It is imperative to delete
Newtonsoftt.Json.Netfrom all project manifests and global package caches domiciled under~/.nuget/packages. - Restrict C2 Infrastructure: Organizations should fortify their defenses by blocking outbound traffic to specified command-and-control IP addresses, such as
185.126.237.64:5341. - Lock Dependencies: To prevent accidental installations stemming from typosquatting, organizations are advised to use lockfiles to pin specific versions of
Newtonsoft.Json.
This incident exemplifies the critical importance of vigilance and proactive measures in safeguarding against emerging threats in the evolving landscape of cyberattacks.