Malicious NuGet Packages Target .NET Developers, Stealing Credentials and Crypto Data A sophisticated campaign is leveraging malicious NuGet packages to steal browser credentials, SSH keys, and cryptocurrency wallet data from developer machines and CI/CD infrastructure, with a focus on Chinese .NET ecosystems. The attack, identified by Socket’s Threat Research Team, involves five packages IR.DantUI, IR.OscarUI, IR.Infrastructure.Core, IR.Infrastructure.DataService.Core, and IR.iplus32 published under the account bmrxntfj. These packages mimic legitimate Chinese WinForms and enterprise libraries, embedding a heavily obfuscated .NET Reactor-protected infostealer. Since late 2025, the packages have accumulated 65,000 downloads across 224 versions, with 219 deliberately hidden to evade detection. The attacker maintains only one visible version at a time, rotating unlisted builds to inflate install counts while avoiding hash-based scans. Execution begins upon loading any IR. assembly, triggering a multi-stage infection process. The malware verifies an RSA-1024 anti-tamper signature, allocates read-write-execute memory, and hooks clrjit.dll!getJit to inject attacker-controlled code during JIT compilation. Cross-platform support ensures functionality on Windows, Linux, and macOS*, with obfuscated API calls to evade static analysis. The infostealer targets 12 Chromium-based browsers (including Chrome, Edge, and Brave), Firefox, and Thunderbird, extracting passwords and session cookies via IElevator COM interface exploitation. It also harvests cryptocurrency wallet data from MetaMask, TronLink, Phantom, Trust Wallet, and Coinbase Wallet, along with files from Exodus, Electrum, and Ledger. Additional targets include SSH keys, Outlook profiles, Steam sessions, and documents from Desktop, Documents, and Downloads directories. Stolen data is staged at C:\ProgramData\Microsoft OneDrive\keys.dat before exfiltration to https://dns-providersa2[.]com/upload, using randomized X-{3 lowercase letters} headers to bypass network signatures. The C2 domain, registered in March 2026, resolves to a VDSINA VPS in Amsterdam and is shielded by privacy-focused registrar Njalla. Attribution links the packages to a unique .NET Reactor RSA public key, connecting them to additional artifacts like s4.exe and fake CRYPT32.DLL.MUI binaries. While YARA rules associate the samples with families like Lumma, Quantum, and AgentRacoon, the exact threat actor remains unclear. A private Alibaba Cloud-hosted Git server (git[.]justdotrip[.]com) is believed to host the operator’s development environment. Any system that restored or loaded these packages since September 2025 should be considered compromised. With 65,000 downloads, the campaign’s impact spans developer workstations and CI/CD pipelines, exposing sensitive data to theft. Defenders are advised to scan for the five package IDs, rotate exposed credentials, and block traffic to the identified C2 infrastructure.