Malicious NuGet Packages Impersonate Chinese UI Libraries — IR.* Infostealer With clrjit.dll JIT Hook, Reactor RSA-1024 Anti-Tamper, and Multi-Browser/Wallet/SSH Theft — Threadlinqs Intelligence
As of 2026-05-30, Malicious NuGet Packages Impersonate Chinese UI Libraries — IR.* Infostealer With clrjit.dll JIT Hook, Reactor RSA-1024 Anti-Tamper, and Multi-Browser/Wallet/SSH Theft is a critical-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-0473 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Five NuGet packages (IR.DantUI, IR.OscarUI, IR.Infrastructure.Core, IR.Infrastructure.DataService.Core, IR.iplus32) published by NuGet account 'bmrxntfj' impersonate Chinese .NET UI/infrastructure
Socket Threat Research disclosed on 2026-05-06 that a NuGet account named 'bmrxntfj' had been publishing weaponized .NET libraries that impersonate the Chinese-language UI library AntdUI and adjacent infrastructure packages. Five packages are confirmed malicious: IR.DantUI (a near-homoglyph of AntdUI), IR.OscarUI, IR.Infrastructure.Core, IR.Infrastructure.DataService.Core, and IR.iplus32. Across these, the operator pushed 224 distinct versions, 219 of which were hidden (unlisted) immediately after publication — a deliberate evasion that lets the operator burn a version after a researcher pulls it while leaving installable copies for victims who pinned earlier numbers. Cumulative download telemetry is ~65,000 since late September 2025, with the campaign predominantly targeting developer workstations and build agents that consume Chinese-language .NET ecosystems.
The core technical innovation is a JIT hook delivered through a module initializer. When the malicious assembly is loaded, the Reactor-protected module initializer first verifies an RSA-1024 signature embedded alongside the payload — a builder-style anti-tamper check that prevents researchers from trivially patching the loader before letting it execute. After the signature check passes, the loader allocates a region of RWX memory via VirtualAlloc(NULL, size, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE), decrypts a stage-2 blob into it, and resolves clrjit.dll!getJit. It overwrites the prologue of getJit so that every subsequent JIT compilation in the host process is intercepted; the hook can rewrite IL or native bytes for any compiled method, providing complete in-process code-substitution capability. The same primitive is implemented for Linux (writing to /proc/self/mem to overwrite the equivalent libclrjit symbol) and macOS (resolving libclrjit.dylib via dlsym and writing through mprotect/RWX), making the technique cross-platform across the .NET runtime.
The in-memory stage drops we4ftg.exe (~786 KB, .NET infostealer) and a helper s4.exe to %ProgramData%, plus two fake DLLs (CRYPT32.DLL.MUI and mscorrc.dll) used as side-loading or proxy targets. we4ftg.exe enumerates 12+ Chromium-based browsers and harvests Login Data, Cookies, Web Data, History, Bookmarks, and Local State; for Chrome 127+ it abuses the AppBound encryption mitigation by instantiating the IElevator COM interface to obtain the decrypted app-bound key, defeating the v20 protection. Firefox and Thunderbird profiles are dumped (key4.db / logins.json / cookies.sqlite), Outlook PST/OST and registry credentials are extracted, the Steam loginusers.vdf and ssfn token are pulled, and OpenSSH %USERPROFILE%\.ssh\id_rsa / id_ed25519 / known_hosts are exfiltrated wholesale. Thirteen cryptocurrency wallets are targeted, including Exodus, Electrum, Atomic, Coinomi, Jaxx, Wasabi, Guarda, Binance, MetaMask (browser extension wallet store), Trust, Phantom, Solflare, and Daedalus. The collection is staged into C:\ProgramData\Microsoft OneDrive\keys.dat (a single-pass archive) and uploaded to https://dns-providersa2[.]com/upload over HTTPS with randomized X-{abc} 3-letter-lowercase headers used as a covert build-tag channel; a /check beacon is used for liveness.
The C2 domain dns-providersa2.com was registered through Njalla (a privacy-forward registrar long associated with criminal infrastructure) on 2026-03-12 and resolved to 62.84.102.85 — a VDSINA VPS in Amsterdam (AS48666). A development/staging server git.justdotrip.com hosted on Alibaba Cloud was used to push code prior to packaging. Pivoting on the RSA-1024 modulus embedded in the Reactor protection scheme yields four additional VirusTotal artifacts that share the same key material with samples attributed to Lumma Stealer, Quantum Stealer, AgentRacoon (an Iran-nexus backdoor disclosed by PAN Unit 42), and ArrowRAT — strongly suggesting a shared builder or operator that supplies multiple infostealer/RAT brands. Attribution remains unset, but the pivot hints at
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-1357
Target sectors: technology, software-development, financial, cryptocurrency, gaming, government, manufacturing, telecommunications
Target regions: Asia, China, North America, Europe, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1583, T1583, T1608, T1587, T1585, T1195, T1195, T1059, T1204, T1129