Executive Summary
A JFrog report published on 21 July 2026 detailed a typosquatted NuGet package, Newtonsoftt.Json.Net, that impersonated the legitimate Newtonsoft.Json library. The malicious package delivered a trojanized JSON library designed specifically to manipulate game results within Digitain’s BetOnGames FG-Crash betting platform.
JFrog identified seven malicious versions that evolved across three generations, with later versions capable of exfiltrating rigged round results to attacker-controlled infrastructure. The malware activates only when the affected application initializes a specific Json.NET setting and exposes the targeted Digitain backend method. Digitain informed JFrog that the issue had been resolved.
Key Takeaways
- The malicious package was named Newtonsoftt.Json.Net, using an additional “t” and the .Net suffix to impersonate the legitimate Newtonsoft.Json package.
- The package contained a trojanized fork of Newtonsoft.Json 13.0.3 and continued functioning as a legitimate JSON library, allowing applications and tests to operate normally.
- Seven malicious versions were published: 11.0.4, 11.0.5, 11.0.7, 11.0.8, 11.0.9, 11.0.10, and 11.0.11.
- The malware used HarmonyLib to alter generated crash game results and inserted rigged rounds among legitimate rounds according to a schedule known only to the attacker.
- The malicious behavior activated only after JsonConvert.DefaultSettings was initialized and after a deliberate delay, helping the payload avoid detection during application startup.
- Later package generations exfiltrated manipulated round results to an attacker-controlled command-and-control endpoint while disguising the traffic as legitimate Seq structured-logging activity.
- The C2 traffic used the header X-Seq-ApiKey: theperfectheist2025 and sent data to 185[.]126[.]237[.]64:5341/api/events/raw.
- JFrog stated that the attacker may have been an insider or someone with access to Digitain’s internal TFS repository; however, the report did not identify a confirmed threat actor.
- The payload did not include credential theft, lateral movement, or general system-persistence capabilities. Its stated purpose was to compromise the integrity of the targeted betting game.
- The package was discoverable through NuGet from August 2025 until October 2025 and remained downloadable from its package page at the time of JFrog’s reporting despite being unlisted.
- Digitain informed JFrog that the issue had been resolved, but JFrog did not have information confirming whether the malicious package had been executed on production systems.
Mitigation Options
The JFrog security research team has provided the following mitigations:
- Remove the Newtonsoftt.Json.Net dependency from every affected project and replace it with the official Newtonsoft.Json 13.0.3 (or newer) from nuget.org. Rebuild and redeploy from a clean restore.
- Purge cached copies: delete newtonsoftt.json.net from the global NuGet package cache (~/.nuget/packages/) and from any internal feed mirror so it cannot be re-resolved.
- Block and investigate the C2: add an egress block for 185[.]126[.]237[.]64:5341, and search historical network logs for past connections to determine the exposure window.
- Pin Newtonsoft.Json to a known good version via packages.lock.json / centralized package version management, and consider a private feed allow-list to prevent typosquatted packages from resolving in future builds.
IOCs
The JFrog security research team has provided a list of indicators of compromises (IOCs) that can be found here:
Package:
- Newtonsoftt.Json.Net (NuGet) – XRAY-1019668
- Versions observed: 11.0.4, 11.0.5, 11.0.7, 11.0.8, 11.0.9, 11.0.10, 11.0.11 (faked to look like Json.NET 11.x; real Json.NET is 13.x)
Network IOCs:
- C2: hxxp[:]//185[.]126[.]237[.]64:5341/api/events/raw
- HTTP header: X-Seq-ApiKey: theperfectheist2025
Code / behavior IOCs:
- Harmony instance id: com.example.harmony
- Patched method: Digitain.FG.SharedCrash.GameLogic.SharedCrashRules.GenerateGameResult
Bundled lib/net8.0/Newtonsoft.Values.Net.dll SHA256s (per version):
- 11.0.4 3fbe32d76a22bda7a8fd3cdc6faf68807108f01d74ec8b346f4c5d4b61dbc84b
- 11.0.5 fe498d584f43b7d6ebe2ebc34481d9b0e8e931d2af039f59451bf42effe8b461
- 11.0.7 5d062e3e52d36d3e66f1c4b54e26149a5b552417f8cc360c390b568aaeb92678
- 11.0.8 ba8f36968c8cdd9799c1d5e5619d1a5d6a0b1eabfd7876daa3cfdebd51dd4516
- 11.0.9 c162009eda7579c3bf5f4fb1606368270c989433d8923d43e033bd5aefc8e335
- 11.0.10 c386d416afef8319bf11c9180f6d35c0e1f7cb40b7a0c81b166c253afc623706
- 11.0.11 4ed6e7b56abece2bef9cdddd0d10da2f8379a09ff94541ed0e70152f669c6682
