Trojanized NuGet Typosquat "Newtonsoftt.Json.Net" Rigs Digitain FG-Crash Betting Platform, Exfiltrates Results via C2
Trojanized NuGet Typosquat "Newtonsoftt.Json.Net" Rigs (TL-2026-1606), also tracked as The Perfect Heist, is a high-severity supply-chain compromise, first published 2026-07-22. It has no confirmed attribution, affects Digitain FG-Crash (SharedCrash game engine), maps to 16 MITRE ATT&CK techniques (T1001, T1027, T1036), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-1606
- Threat ID
- TL-2026-1606
- Also known as
- The Perfect Heist
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-22
- Last reviewed
- 2026-07-22
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- gambling, igaming, software supply chain, technology
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Trojanized NuGet Typosquat "Newtonsoftt.Json.Net" Rigs
Malware and tooling: ConfuserEx, Dotfuscator, HarmonyLib
A typosquatted NuGet package impersonating Newtonsoft.Json (named Newtonsoftt.Json.Net) shipped seven versions between August-October 2025 with a trojanized JsonConvert.DefaultSettings hook that rigs outcomes in Digitain's FG-Crash online betting game and, from generation 2 onward, exfiltrates rigged round results to an attacker-controlled server disguised as Seq telemetry. The package's metadata leaked Digitain's internal TFS repository URL across all seven versions, indicating the attacker had access to the FG-Crash source code.
How Trojanized NuGet Typosquat "Newtonsoftt.Json.Net" Rigs works
JFrog Security Research (analyst Guy Korolevski) discovered and disclosed "Newtonsoftt.Json.Net" (double-t, .Net suffix) — a typosquat of the ubiquitous Newtonsoft.Json library — published to the NuGet Gallery by an unverified account ("MagicalPuff96") across seven versions (11.0.4, 11.0.5, 11.0.7-11.0.11) from August 13 to October 10, 2025, accumulating roughly 1,200 downloads before being unlisted. The package bundles a real, functioning fork of Newtonsoft.Json 13.0.3 (Newtonsoft.Json.net.dll) alongside two malicious components: Newtonsoft.Values.Net.dll (rigging/exfiltration payload) and 0Harmony.dll (the HarmonyLib runtime-patching library). Developers who typo-install the package get working JSON serialization; the trojan activates only when the host application calls the JsonConvert.DefaultSettings property setter, at which point the payload swaps in a custom CamelCasePropertyNamesContractResolver and schedules a delayed Harmony patch (10-minute timer in the final generation) under Harmony instance ID "com.example.harmony", specifically targeting the method Digitain.FG.SharedCrash.GameLogic.SharedCrashRules.GenerateGameResult. This environment-keyed design means the payload is dormant and undetectable on any host that does not expose Digitain's specific FG-Crash backend method, and activation is deliberately delayed past application startup so startup logs appear clean.
The malware evolved across three generations. Generation 1 (v11.0.7, 11.0.8; Dotfuscator-obfuscated, base64 strings visible in the #US heap) used an IL transpiler to rewrite compiled crash-coefficient logic, selecting rigged outcomes from lookup tables indexed by month, day-of-week, and week-of-month, capping manipulation at 27 rounds, with a distinct betting-strategy carve-out for the 22:00 UTC window. Generation 2 (v11.0.4, 11.0.5, 11.0.9; heavy ConfuserEx encryption, reflection-based networking to hide HttpClient usage) added exfiltration of rigged results to 185.126.237.64:5341/api/events/raw, authenticated with header "X-Seq-ApiKey: theperfectheist2025" and deliberately structured to mimic a Seq structured-logging server's ingestion schema so the traffic blends with legitimate application telemetry. Generation 3 (v11.0.10, light ConfuserEx; v11.0.11, completely unobfuscated — apparently an accidental clean build) simplified the rigging to a direct postfix overwrite of the return value, capped at 32 rounds, and stabilized the exfiltration path. No version implements credential theft, host persistence beyond the patched process, or lateral movement — the payload is single-purpose, aimed exclusively at compromising FG-Crash game-outcome integrity and monetizing knowledge of rigged results.
The package's nuspec metadata deliberately (or carelessly) embedded a repository URL pointing to Digitain's internal TFS server, project path BetOnGames/FG-Crash, identically across all seven versions — strong forensic evidence that the threat actor had direct access to Digitain's proprietary FG-Crash source tree, elevating this from a generic typosquat to a targeted, insider-informed supply-chain attack against a single named victim. JFrog tracks detection as XRAY-1019668; JFrog Curation also flags the package. Digitain acknowledged awareness and stated remediation was underway; full exposure scope was undisclosed at time of reporting.
MITRE ATT&CK techniques used in TL-2026-1606
Command and Control
T1001 Data Obfuscation; T1071 Application Layer Protocol; T1132 Data Encoding
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1480 Execution Guardrails; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Initial Access
Discovery
stealth
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1608 Stage Capabilities
Impact
Affected products and versions in Trojanized NuGet Typosquat "Newtonsoftt.Json.Net" Rigs
- Digitain — FG-Crash (SharedCrash game engine)
Vulnerable versions: any deployment resolving the Newtonsoftt.Json.Net dependency
Fixed in: N/A - dependency-level compromise; mitigated by package removal and dependency pinning - NuGet Community (malicious publisher) — Newtonsoftt.Json.Net
Vulnerable versions: 11.0.4; 11.0.5; 11.0.7; 11.0.8; 11.0.9; 11.0.10; 11.0.11
Fixed in: package unlisted from NuGet Gallery
Remediation for Trojanized NuGet Typosquat "Newtonsoftt.Json.Net" Rigs
Immediate actions
- Remove the Newtonsoftt.Json.Net package from any project and clear the local NuGet cache (~/.nuget/packages/newtonsoftt.json.net)
- Block egress to 185.126.237.64:5341
- Reinstall the official Newtonsoft.Json package (13.0.3 or later) from nuget.org
- Audit application logs/telemetry sinks for outbound POSTs to /api/events/raw carrying the X-Seq-ApiKey: theperfectheist2025 header
Workarounds
- Pin Newtonsoft.Json to a known-good version via packages.lock.json to prevent silent resolution of the typosquat
Longer-term hardening
- Implement a private/curated NuGet feed allowlist to prevent future typosquat installs
- Adopt automated typosquat/dependency-name-similarity scanning in CI (e.g., JFrog Xray/Curation)
- Review third-party contributor and CI access to proprietary game-logic repositories (BetOnGames/FG-Crash) given evidence of source-code leakage
Weaknesses (CWE) in Trojanized NuGet Typosquat "Newtonsoftt.Json.Net" Rigs
CWE-506, CWE-1357
Timeline of Trojanized NuGet Typosquat "Newtonsoftt.Json.Net" Rigs
- Newtonsoftt.Json.Net v11.0.4 (Generation 2: ConfuserEx-encrypted, reflection-hidden HttpClient) published to NuGet Gallery by unverified account MagicalPuff96 — first version with exfiltration capability.
- v11.0.5 (Gen-2), v11.0.7 and v11.0.8 (Generation 1: Dotfuscator-obfuscated IL transpiler, local-rigging-only, no exfiltration), and v11.0.9 (Gen-2) all published the same day, indicating rapid parallel iteration of rigging and obfuscation approaches.
- v11.0.10 published: Generation 3 payload — light ConfuserEx, simplified postfix patch overwriting GenerateGameResult's return value directly, capped at 32 rigged rounds.
- v11.0.11 published completely unobfuscated — apparently an accidental clean build — the last version before the package was pulled; total downloads across all seven versions reached roughly 1,200.
- JFrog Security Research privately discloses its findings to Digitain, providing details of the trojanized package, the targeted GenerateGameResult method, and the C2 endpoint ahead of public disclosure.
- Digitain confirms awareness of the campaign to JFrog and states remediation is underway, two weeks before public disclosure.
- JFrog Security Research (Guy Korolevski) publishes "The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results," disclosing the campaign; package unlisted from NuGet Gallery; JFrog Xray/Curation add detection coverage (XRAY-1019668).
- Digitain confirms awareness of the campaign and states remediation steps are underway; full scope of exposure remains undisclosed.
- The Hacker News reports on the campaign, amplifying JFrog's findings to a broader security audience.
Sources cited for Trojanized NuGet Typosquat "Newtonsoftt.Json.Net" Rigs
- Trojanized Newtonsoft.Json Fork Hides Malicious Payload Targeting Digitain Betting Platform
- The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results
- Guy Korolevski | JFrog (researcher profile)
- NuGet Gallery | Newtonsoft.Json (official package)
- JamesNK/Newtonsoft.Json (upstream legitimate project)
Threats related to Trojanized NuGet Typosquat "Newtonsoftt.Json.Net" Rigs
- Indirect Setup-Error Prompt Abuse: Clean GitHub Repo + Failing Python Package + DNS TXT Payload Tricks AI Coding Agents (Claude Code) into Running a Reverse Shell
- Compromised @injectivelabs/sdk-ts npm Package (v1.20.21) Exfiltrates Cryptocurrency Wallet Mnemonics and Private Keys via Fake Telemetry
- Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Detection coverage for TL-2026-1606
As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1606 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.