Trojanized Newtonsoft.Json Fork Targets Online Betting Platform with Game-Rigging Malware
A typosquatting package on NuGet, 'Newtonsoftt.Json.Net,' has been discovered to contain malicious code designed to rig live game results on the Digitain betting platform, rather than steal data.
Cybersecurity researchers have identified a sophisticated supply chain attack originating from the NuGet package registry. A package named 'Newtonsoftt.Json.Net,' which mimics the legitimate and widely used Newtonsoft.Json library, was found to be a trojanized fork containing malicious code.
This malicious package was distributed in seven different versions (11.0.4, 11.0.5, 11.0.7, 11.0.8, 11.0.9, 11.0.10, and 11.0.11) and has been downloaded approximately 1,200 times. While the package has since been unlisted by its owner, MagicalPuff96, the malicious artifacts remain accessible on the registry.
The trojan's primary objective is not traditional data theft but rather to manipulate live game results specifically on Digitain, an online betting platform. According to JFrog security researchers, later versions of the malware exfiltrate rigged round results to an attacker-controlled server using the 'X-Seq-ApiKey: theperfectheist2025' header.
What makes this attack particularly noteworthy is its targeted nature. Developers who inadvertently install the package due to a typo receive a fully functional version of Newtonsoft.Json. The malicious behavior is only triggered after the host application initializes JsonConvert.DefaultSettings, and it requires specific conditions related to the target's game backend methods to succeed, often with a deliberate delay to evade detection.
All seven published versions contain the same trojanized fork, evolving across three generations between August and October 2025. The backdoor initiates itself by altering the DefaultSettings property setter. This modification allows for the execution of attacker-controlled code, including a randomized delay mechanism to bypass security monitoring before the rigging functionality is activated.
The ultimate goal of the malware is to compromise the integrity of Digitain's crash-game backend. Rigged results are then exfiltrated to a hard-coded IP address (185.126.237[.]64:5341), disguised as telemetry data. The progression of the malware across its generations shows an iterative hardening process, from a local-only proof of concept to more sophisticated obfuscation and exfiltration techniques.
Evidence suggests the author had access to the source code of Digitain's FG-Crash betting game, as the package metadata leaked an internal Digitain repository URL seven times. The trojan specifically targets a method present in the FG-Crash backend, ensuring that non-targeted consumers experience no adverse effects, thus enhancing the attack's stealth.
To mitigate this threat, developers are advised to remove the malicious package, block the identified command-and-control server, and implement package pinning using packages.lock.json to ensure only trusted versions of Newtonsoft.Json are used. Digitain has confirmed awareness of the issue and stated that measures have been taken to resolve it, though the full scope of the compromise remains unclear.