Ethical Hacking News
A recent vulnerability has been discovered in a Trojanized NuGet package that poses a significant risk to game-rigging attacks targeting the online betting platform Digitain. The researchers found that the malicious code is designed to rig live game results on Digitain's FG-Crash betting game platform and exfiltrate rigged results to an attacker-controlled server. To counter this threat, developers are advised to remove the typosquat package, block the command-and-control (C2) address, and pin Newtonsoft.Json to a known-good version via packages.lock.json.
The Trojanized NuGet package poses a vulnerability to game-rigging attacks targeting Digitain's online betting platform. The malicious code is designed to rig live game results on the FG-Crash betting game platform, but only activates when targeting a specific backend method. The attacker had access to the source code of FG-Crash and used internal repository URLs to create the Trojanized package. The package exfiltrates rigged round results to an attacker-controlled server using a randomized delay to sidestep detection. Removal of the package, blocking command-and-control addresses, and pinning Newtonsoft.Json to a known-good version are recommended countermeasures.
A recent discovery by cybersecurity researchers has exposed a Trojanized NuGet package that poses a significant vulnerability to game-rigging attacks, specifically targeting the online betting platform Digitain. The package in question is masquerading as the legitimate Newtonsoft.Json library and has been published under several versions, with the majority of them being released between August 13 and October 10, 2025.
The researchers found that the Trojanized package was designed to rig live game results on Digitain's FG-Crash betting game platform. The malicious code is triggered when the JsonConvert.DefaultSettings property is assigned, which is a common setting used in the Newtonsoft.Json library. However, unlike typical info-stealers, this Trojanized package only activates when it specifically targets the FG-Crash backend method.
The researchers noted that the package metadata contains internal Digitain repository URLs seven times across all the published versions, indicating that the author had access to the source code of FG-Crash. This suggests that the attacker had a level of sophistication and knowledge about the target platform.
Furthermore, the Trojanized package was designed to exfiltrate rigged round results to an attacker-controlled server using the header X-Seq-ApiKey: theperfectheist2025. The package also utilizes a randomized delay as a way to sidestep detection before the malicious functionality is fired.
The researchers stated that there is no credential theft, persistence, or lateral-movement capability in the payload. Its sole purpose is to compromise the integrity of the crash game. Other developers who installed this package may not even notice that they installed malware, or have any negative results in their application since it is only targeting a specific organization.
To counter the threat, developers are advised to remove the typosquat package, block the command-and-control (C2) address, and pin Newtonsoft.Json to a known-good version via packages.lock.json. Digitain, for its part, has revealed that it was aware of the issue and had taken steps to resolve it.
The discovery highlights the importance of maintaining up-to-date software and being cautious when installing new packages. It also underscores the need for robust security measures in place to prevent such attacks from succeeding.
Related Information:
https://www.ethicalhackingnews.com/articles/Trojanized-NuGet-Package-Exposes-Vulnerability-to-Game-Rigging-Attack-via-Digitain-ehn.shtml
https://thehackernews.com/2026/07/trojanized-newtonsoftjson-fork-hides.html
Published: Wed Jul 22 12:06:44 2026 by llama3.2 3B Q4_K_M
