Listen to this Post
Introduction: When Trusted Code Becomes a Hidden Threat
Open-source repositories are the backbone of modern software development, especially in the cryptocurrency ecosystem where speed and interoperability matter. Developers often rely on well-known libraries to integrate wallets, blockchains, and payment logic into their applications. However, a newly uncovered malicious campaign shows how this trust can be weaponized. Security researchers at ReversingLabs have identified a coordinated attack on the NuGet platform, where attackers published counterfeit .NET crypto libraries designed to silently steal wallets, redirect transactions, and hijack advertising accounts. What makes this campaign particularly dangerous is not just the malware itself, but how convincingly it blends into the open-source supply chain.
Campaign Discovery and Timeline
ReversingLabs researchers traced the campaign back to July 2025, when a series of suspicious NuGet packages began appearing under names closely resembling legitimate cryptocurrency development tools. In total, 14 malicious packages were identified, all carefully crafted to look authentic, functional, and actively maintained. These packages were not broken or obviously malicious on the surface, making them especially dangerous for developers who rely on quick dependency installs.
Impersonating Trusted Crypto Libraries
A key element of the campaign was impersonation. One of the most notable examples was a fake library named Netherеum.All, designed to mimic Nethereum, a widely used .NET integration library for Ethereum. The deception went further than simple naming. The attackers used homoglyph techniques, substituting visually identical characters from different alphabets, making the package name appear legitimate at a glance.
Copycat Branding Across the Ecosystem
Netherеum.All was not an isolated case. Other malicious packages impersonated well-known crypto-related libraries such as Solnet, NBitcoin, and Coinbase.Net. Each of these names carries strong credibility within the .NET and crypto developer communities. By leveraging this familiarity, attackers dramatically increased the chances that developers would trust and install the packages without deeper inspection.
Functional Code Used as a Trojan Horse
One of the most effective aspects of the attack was that the packages actually worked. Developers could install them, compile projects, and interact with blockchain networks as expected. This functionality served as camouflage. Beneath the legitimate-looking logic, hidden malicious routines were embedded and executed silently during runtime.
Classification of the Malicious Packages
ReversingLabs categorized the 14 packages into three distinct functional groups based on their malicious behavior. Each group targeted a different type of valuable asset, ranging from cryptocurrency wallets to advertising credentials. This modular approach suggests careful planning and a clear monetization strategy rather than opportunistic malware distribution.
Wallet Stealers Hidden in Plain Sight
Nine of the identified packages, including Netherеum.All, functioned primarily as wallet stealers. These packages injected additional code that executed a concealed function named “Shuffle.” The name itself was intentionally generic, designed to avoid suspicion during casual code review.
Harvesting Sensitive Wallet Data
Once triggered, the Shuffle function collected a wide range of sensitive information. This included wallet addresses, private keys, seed phrases, and Wallet Import Format (WIF) keys. With this data, attackers could fully reconstruct victims’ wallets and drain funds without further interaction.
Command-and-Control Infrastructure Disguised as Legitimate
The stolen data was transmitted to a remote command-and-control endpoint hosted at hxxps://solananetworkinstance[.]info/api/gads. The domain was deliberately crafted to resemble a legitimate Solana-related service, reducing the likelihood that outbound traffic would raise alarms or be blocked by basic security controls.
Transaction Hijacking Through Code Manipulation
Another subset of packages focused on transaction redirection rather than data theft. A notable example was Coinbase.Net.Api, which modified internal logic within the SendMoneyAsync function. Instead of sending funds to the intended recipient, the function silently replaced the destination address with an attacker-controlled wallet.
Selective Theft to Avoid Detection
To remain under the radar, the attackers applied a transaction threshold. Only transfers exceeding $100 were altered. Smaller transactions proceeded normally, helping the malicious behavior blend into normal usage patterns while still enabling steady financial theft over time.
Targeting Google Ads Accounts
The final group of malicious packages had a different objective altogether. Packages such as Google Ads.API focused on stealing OAuth credentials associated with developers’ Google Ads accounts. Once compromised, attackers gained full access to advertising campaigns, budgets, and billing methods.
Monetization Beyond Cryptocurrency
By hijacking Google Ads accounts, threat actors could spend advertising budgets fraudulently, promote malicious content, or resell access to compromised accounts. This diversification shows that the campaign was not limited to crypto theft but aimed at extracting value wherever possible.
Social Engineering as a Core Strategy
The technical malware was only half the operation. Social engineering played a central role in making the packages appear trustworthy. Attackers used realistic version numbers, frequent updates, and professional-looking documentation to simulate active maintenance.
Inflated Download Metrics
Artificially inflated download counts were used to suggest widespread adoption. Developers browsing NuGet often rely on popularity metrics as a shortcut for trust, and the attackers exploited this behavior effectively.
Homoglyph Attacks and Visual Deception
By using visually indistinguishable characters in package names, the attackers bypassed quick visual checks. Even experienced developers could easily overlook the subtle differences, especially when installing dependencies under time pressure.
Downstream Risk to End Users
While developers were the initial targets, the true impact extended far beyond them. Applications built using these compromised dependencies could unknowingly expose end users to wallet theft, credential leakage, and financial loss.
Organizational and Enterprise Exposure
In corporate environments, a single compromised dependency can cascade across multiple projects. This raises the risk of large-scale breaches, regulatory issues, and reputational damage, especially for fintech and blockchain-focused companies.
ReversingLabs’ Recommendations
ReversingLabs urged developers to verify package authenticity before installation, closely review source code for obfuscation or suspicious network activity, and use pre-installation analysis tools such as Spectra Assure Community.
A Broader Supply Chain Warning
This campaign reinforces a growing reality in cybersecurity: even trusted repositories like NuGet are not immune to abuse. The open-source model depends heavily on trust, and attackers are increasingly exploiting that trust as the weakest link.
What Undercode Say:
A Calculated Evolution of Supply Chain Attacks
This campaign reflects a mature evolution in supply chain threats. Rather than deploying crude malware, attackers embedded malicious logic into functional, developer-friendly libraries. This dramatically increases dwell time and reduces the likelihood of early detection.
Developers as High-Value Targets
Crypto developers hold keys not only to their own wallets but also to the infrastructure used by thousands or millions of users. Targeting developers through dependency poisoning offers attackers exponential returns compared to traditional phishing.
Blurring the Line Between Legitimate and Malicious Code
The use of working functionality alongside hidden malicious routines makes detection significantly harder. Static analysis alone may not reveal intent, pushing defenders toward behavioral analysis and runtime monitoring.
Economic Incentives Drive Sophistication
The selective transaction threshold and diversified monetization methods indicate a strong focus on long-term profit rather than smash-and-grab theft. This suggests organized threat actors with financial backing.
Open-Source Trust Models Need Rethinking
Popularity metrics, download counts, and name recognition are no longer reliable trust indicators. This campaign demonstrates how easily these signals can be manipulated.
Dependency Hygiene Is Now a Security Control
Reviewing dependencies is no longer just a best practice; it is a security requirement. Automated scanning, code signing, and provenance verification should become standard in crypto development pipelines.
The Hidden Cost of Convenience
Package managers prioritize speed and ease of use, but this convenience comes at a cost. Attackers thrive where friction is low, and NuGet is no exception.
Long-Term Impact on the Crypto Ecosystem
Repeated incidents like this erode trust in open-source crypto tooling. Over time, this could slow innovation or push developers toward closed ecosystems with higher barriers to entry.
Fact Checker Results
Verification of Core Claims
The campaign details align with ReversingLabs’ findings and known NuGet abuse patterns.
Technical Plausibility
The described techniques are consistent with real-world .NET dependency attacks.
Overall Accuracy
Claims are technically sound and internally consistent. ✅❌✅
Prediction
Increased Targeting of Developer Ecosystems
Supply chain attacks against developers will accelerate as defenses improve elsewhere 🔮
Stronger Repository Controls Ahead
Platforms like NuGet will face pressure to implement stricter verification and monitoring 🔐
Rising Demand for Dependency Intelligence
Security tooling focused on open-source risk will become a standard requirement 📊
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.stackexchange.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
