Malicious NuGet Package Used One Extra “t” to Manipulate Betting Results

A malicious NuGet package named Newtonsoftt.Json.Net impersonated the popular Newtonsoft.Json library while hiding code designed to manipulate results in Digitain’s FG-Crash betting-game backend.

The counterfeit package added one extra “t” to the Newtonsoft name and included a misleading .Net suffix. According to JFrog Security Research, the package functioned as a normal JSON library for most developers but activated targeted fraud code when it detected Digitain’s game backend.

The threat actor published seven malicious versions between August 13 and October 10, 2025. NuGet later removed the package from search results, and its gallery listing now states that the package violated its terms and can no longer support installation or restoration.

Typosquatting Made the Package Look Legitimate

Typosquatting relies on package names that closely resemble trusted dependencies. A developer searching quickly or typing the name manually could mistake Newtonsoftt.Json.Net for the genuine Newtonsoft.Json package.

The attacker also copied metadata from the legitimate project. The package claimed James Newton-King as its author, linked to the official Json.NET website, used the Json.NET title, referenced the MIT licence, and followed a believable 11.0.x version pattern.

The real Newtonsoft.Json package uses the shorter name without the extra “t” or .Net suffix. Its current stable release is version 13.0.4, while NuGet reserves its package prefix to help users identify the authentic library.

Detail	Malicious package	Official package
Package name	Newtonsoftt.Json.Net	Newtonsoft.Json
Notable difference	Extra “t” and added .Net suffix	Original name
Observed versions	11.0.4 to 11.0.11, with gaps	Current stable version 13.0.4
Purpose	Targeted betting-result manipulation	Legitimate JSON serialization
Current NuGet status	Deleted and unavailable for restore	Available with a reserved prefix

Why Applications Continued Working Normally

The package contained a trojanized fork of Newtonsoft.Json 13.0.3. It preserved the genuine library’s normal serialization features, so applications could build successfully and pass routine tests after developers installed it.

Inside its lib/net8.0 directory, the package included three assemblies. NuGet automatically references assemblies in this directory, allowing the malicious payload to load without requiring developers to call it directly.

• Newtonsoft.Json.net.dll, a trojanized fork containing the activation trigger
• Newtonsoft.Values.Net.dll, the malicious game-rigging payload
• 0Harmony.dll, the legitimate HarmonyLib runtime-patching library

HarmonyLib itself did not contain malicious code. The attacker used its runtime-patching features to modify a game function after the host application loaded the package.

A Modified JSON Setting Triggered the Payload

The malicious code connected itself to the JsonConvert.DefaultSettings property setter. Applications commonly use this property during startup to define global JSON serialization settings.

When an application assigned DefaultSettings, the trojan replaced the selected contract resolver with its own resolver. It then scheduled the runtime patch through a timer rather than activating it immediately.

This delay reduced the chance that developers would notice suspicious behavior during application startup or initial testing. Some versions waited ten minutes, while earlier variants could wait until approximately 3 p.m. on the following day and add a random delay.

The Trojan Targeted Digitain’s FG-Crash Backend

The payload searched for a specific class and method in Digitain’s betting software:

Target class	Digitain.FG.SharedCrash.GameLogic.SharedCrashRules
Target method	GenerateGameResult
Target product	Digitain or BetOnGames FG-Crash
Modification tool	HarmonyLib
Harmony identifier	com.example.harmony

FG-Crash belongs to a category of crash-style betting games in which a multiplier increases until the round ends. Players must cash out before the multiplier stops to collect winnings.

By altering GenerateGameResult, the payload could change the crash multiplier returned by the game backend. The attacker could schedule selected outcomes and gain advance knowledge of manipulated rounds.

The malicious package metadata also exposed an internal Digitain Team Foundation Server repository connected to BetOnGames and FG-Crash. Every published version included this information, suggesting that the package creator had access to internal project details or source code.

Seven Versions Developed Across Three Generations

JFrog divided the seven package versions into three malware generations. The attacker changed the obfuscation, result-manipulation method, and data-exfiltration process over time.

Version	Generation	Obfuscation	Upload date
11.0.4	Generation 2	Heavy ConfuserEx	August 13, 2025
11.0.5	Generation 2	Heavy ConfuserEx	August 16, 2025
11.0.7	Generation 1	Dotfuscator	August 16, 2025
11.0.8	Generation 1	Dotfuscator	August 16, 2025
11.0.9	Generation 2	Heavy ConfuserEx	August 16, 2025
11.0.10	Generation 3	Light ConfuserEx	October 6, 2025
11.0.11	Generation 3	None	October 10, 2025

Generation 1 acted like a local proof of concept. It patched the target method and printed manipulated values to the console but did not send results to an external server.

Generation 2 introduced data exfiltration and used reflection, encrypted constants, and heavy ConfuserEx obfuscation to hide its network activity. Generation 3 simplified the manipulation method and stabilized the exfiltration process.

Version 11.0.11 contained no code obfuscation. This exposed the command-and-control address, API key, request structure, and target method, helping researchers reconstruct the complete operation.

Latest Version Disguised Exfiltration as Logging Traffic

Version 11.0.11 sent manipulated game results to an attacker-controlled server. It formatted the requests to resemble events sent to Seq, a structured logging platform commonly used with .NET applications.

The malware used the /api/events/raw path, a JSON event structure, and an X-Seq-ApiKey header. This design could make malicious outbound traffic resemble ordinary application telemetry.

The attacker could use the transmitted data to learn manipulated round results in advance, confirm that the payload remained active, and maintain an external record of the fraud.

Indicator type	Indicator
JFrog detection	XRAY-1019668
Malicious package	Newtonsoftt.Json.Net
Command-and-control host	185.126.237[.]64:5341
Request path	/api/events/raw
HTTP header	X-Seq-ApiKey: theperfectheist2025
Payload assembly	Newtonsoft.Values.Net.dll
Trojanized assembly	Newtonsoft.Json.net.dll
Runtime-patching assembly	0Harmony.dll

Other Developers May Not Have Seen Malicious Activity

The payload required two specific conditions. The application had to assign JsonConvert.DefaultSettings, and the host needed to expose Digitain’s FG-Crash GenerateGameResult method.

Applications without that method could continue using the counterfeit package as a functional JSON library. Developers might see no errors, suspicious output, credential theft, or obvious system changes.

JFrog found no credential-stealing, lateral-movement, or traditional host-persistence features. The package focused on compromising the integrity of one betting-game backend rather than infecting large numbers of unrelated systems.

Digitain Says It Resolved the Issue

JFrog informed Digitain about the package on July 7, 2026. Digitain responded on July 9 and said it already knew about the issue and had resolved it.

Neither JFrog nor Digitain disclosed whether the malicious package ever ran on production systems. As a result, researchers cannot confirm whether attackers successfully manipulated live betting rounds or caused financial losses.

The official NuGet package page now says NuGet deleted the content because it violated the platform’s terms. Developers can no longer install or restore the package directly from the public gallery, but cached copies and internal mirrors may remain available inside organizations.

How Developers Should Remove the Malicious Package

Teams should search source repositories, project files, dependency manifests, lock files, build records, artifact repositories, and internal package mirrors for Newtonsoftt.Json.Net and its seven known versions.

1. Remove every Newtonsoftt.Json.Net dependency reference.
2. Replace it with the official Newtonsoft.Json 13.0.4 release or another approved version.
3. Delete newtonsoftt.json.net from global NuGet caches.
4. Remove cached packages from internal feeds and artifact repositories.
5. Perform a clean package restore, rebuild, and deployment.
6. Block outbound connections to 185.126.237[.]64 on port 5341.
7. Search historical network logs for connections to the listed host and port.
8. Review build logs to identify when teams introduced or restored the dependency.
9. Check deployed systems for the malicious DLLs and known SHA-256 hashes.

Developers should also use packages.lock.json or central package management to pin approved dependency versions. Private package feeds can apply allowlists and block packages whose names closely resemble trusted dependencies.

Organizations should verify package identity through the exact package name, reserved-prefix status, owner information, download history, source repository, and digital signature. A functioning dependency does not prove that the package came from the expected publisher.

The full JFrog investigation includes the SHA-256 hashes for every observed payload version. Security teams can use those hashes alongside the package name, network address, header value, and targeted method during incident-response searches.

FAQ