Malicious NuGet Package Targets Digitain’s Betting Backend with Rigged Game Results Security researchers at JFrog uncovered a sophisticated supply-chain attack leveraging a typosquatted NuGet package, Newtonsoftt.Json.Net, designed to impersonate the legitimate Newtonsoft.Json library. The malicious package, disguised as a standard JSON framework, selectively targeted Digitain’s FG-Crash betting backend to manipulate game outcomes and exfiltrate results to an attacker-controlled server. The package, versions 11.0.4 through 11.0.11, closely mimicked the official Json.NET branding, including metadata pointing to the real project URL and a plausible versioning scheme. Under the hood, it bundled a trojanized fork of Newtonsoft.Json, a payload DLL, and the Harmony runtime-patching library, ensuring malicious code executed whenever the JSON library was invoked. The attack employed a delayed trigger via a booby-trapped JsonConvert.DefaultSettings setter, replacing the host’s resolver and scheduling a Harmony patch to activate minutes or hours later. Once active, the malware hooked GenerateGameResult, altering crash-game coefficients using deterministic lookup tables or direct return-value manipulation based on time-based variables (e.g., month, day of week, or a 22:00 UTC window). Exfiltrated data was disguised as Seq logging traffic, blending with legitimate observability data to evade detection. The campaign was narrowly scoped, focusing solely on manipulating Digitain’s crash-game results for financial gain rather than credential theft or lateral movement. The attacker exploited a pre-known schedule of rigged rounds, enabling preferential payouts or guaranteed wins while limiting exposure by unhooking Harmony after a set number of manipulations. JFrog responsibly disclosed the issue to Digitain, which confirmed the threat had been identified and mitigated. However, details on whether the attack resulted in production exploitation remain undisclosed. The malicious package has since been unlisted from NuGet.