Trojanized Newtonsoft.Json Fork Targets Digitain Betting Platform in NuGet Typosquat Attack

Cybersecurity researchers at JFrog have uncovered a sophisticated NuGet typosquatting campaign targeting the popular Newtonsoft.Json library. The malicious package, named “Newtonsoftt.Json.Net,” is a trojanized fork designed specifically to rig live game results on the Digitain online betting platform, rather than stealing information like typical malware.

Seven versions of the package were published to the NuGet repository between August 13 and October 10, 2025, accumulating approximately 1,200 downloads. The package was created by a user named MagicalPuff96 and has since been unlisted, though the artifacts remain available for download.

The trojan operates by masquerading as a legitimate Newtonsoft.Json build. Developers who install it by typo receive a fully functional library, but malicious behavior triggers after the host initializes JsonConvert.DefaultSettings. The backdoor introduces a randomized delay to evade detection before targeting servers running Digitain’s crash-game backend. Rigged results are exfiltrated to an attacker-controlled server at 185.126.237[.]64:5341, disguised as telemetry data, using the header X-Seq-ApiKey: theperfectheist2025.

JFrog researchers identified three generations of the malware across the seven versions, showing iterative hardening: Gen-1 was a local-only proof of concept, Gen-2 added exfiltration hidden behind reflection and ConfuserEx obfuscation, and Gen-3 cleaned up the rigging and stabilized exfiltration. Version 11.0.11 was left completely unobfuscated, likely an accidental clean build.

The package metadata leaked an internal Digitain repository URL in all versions, indicating the author had access to FG-Crash’s source code. The trojan specifically targets Digitain’s FG-Crash betting game and has no credential theft, persistence, or lateral movement capabilities. Digitain has acknowledged the issue and taken steps to resolve it, but the full extent of the exposure remains unknown.

Developers are advised to remove the typosquat package, block the C2 address, and pin Newtonsoft.Json to a known-good version via packages.lock.json.