--- title: The Perfect Heist: NuGet Typosquat Targets Betting... description: JFrog Security Research uncovered a targeted NuGet typosquatting attack using a package named 'Newtonsoftt.Json.Net' (double 't') that impersonates the popular... canonical: https://daily.dev/posts/the-perfect-heist-nuget-typosquat-targets-betting-platform-to-rig-results-rohtlqazt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results | daily.dev og:description: JFrog Security Research uncovered a targeted NuGet typosquatting attack using a package named 'Newtonsoftt.Json.Net' (double 't') that impersonates the popular... og:url: https://daily.dev/posts/the-perfect-heist-nuget-typosquat-targets-betting-platform-to-rig-results-rohtlqazt og:image: https://api.daily.dev/og/posts/rOHtlqazt.png og:image:alt: The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results **[JFrog](https://daily.dev/sources/jfrog)** · 14 min read · 0 upvotes · 0 comments ## Summary JFrog Security Research uncovered a targeted NuGet typosquatting attack using a package named 'Newtonsoftt.Json.Net' (double 't') that impersonates the popular Newtonsoft.Json library. The malicious package ships a trojanized JSON fork bundled with HarmonyLib and a payload DLL specifically targeting Digitain's FG-Crash betting game. It uses a delayed Harmony patch to rig the game's GenerateGameResult method, manipulating crash multipliers on a deterministic schedule only the attacker knows. Seven versions were published across three generations, evolving from a local-only proof-of-concept to a version that exfiltrates rigged results to a C2 server disguised as Seq structured logging traffic. The package works normally for all non-targeted developers, making it nearly undetectable. Digitain confirmed awareness and resolution of the issue, though the full production impact is unknown. Remediation steps include removing the package, purging caches, blocking the C2 IP, and pinning legitimate package versions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Four Malicious NuGet Packages Target ASP.NET Developers With...](https://daily.dev/posts/four-malicious-nuget-packages-target-asp-net-developers-with--57ffqqvc1) · Socket · 2 upvotes · 0 comments - [Rogue NuGet Package Poses as Tracer.Fody, Steals Cryptocurrency Wallet Data](https://daily.dev/posts/rogue-nuget-package-poses-as-tracer-fody-steals-cryptocurrency-wallet-data-t9ujekhee) · The Hacker News · 0 upvotes · 0 comments - [North Korea-linked npm packages impersonate Rollup polyfill tools to steal developer secrets](https://daily.dev/posts/north-korea-linked-npm-packages-impersonate-rollup-polyfill-tools-to-steal-developer-secrets-mvjcouuhx) · The Next Web · 2 upvotes · 1 comments - [5 Malicious NuGet Packages Impersonate Chinese UI Libraries ...](https://daily.dev/posts/5-malicious-nuget-packages-impersonate-chinese-ui-libraries--yl9iga3kk) · Socket · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#nuget](https://daily.dev/tags/nuget) [View this post on daily.dev](https://daily.dev/posts/the-perfect-heist-nuget-typosquat-targets-betting-platform-to-rig-results-rohtlqazt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results","url":"https://daily.dev/posts/the-perfect-heist-nuget-typosquat-targets-betting-platform-to-rig-results-rohtlqazt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-perfect-heist-nuget-typosquat-targets-betting-platform-to-rig-results-rohtlqazt"},"datePublished":"2026-07-21T13:16:47.695Z","dateModified":"2026-07-21T13:17:13.928Z","description":"JFrog Security Research uncovered a targeted NuGet typosquatting attack using a package named 'Newtonsoftt.Json.Net' (double 't') that impersonates the popular...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c6319ab25dd4462ddcbc6b3b2d1d329?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c6319ab25dd4462ddcbc6b3b2d1d329?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"JFrog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"JFrog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/b11bf37102384ac9983be701b2cf7cd5","url":"https://daily.dev/sources/jfrog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-perfect-heist-nuget-typosquat-targets-betting-platform-to-rig-results-rohtlqazt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,nuget","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"JFrog","item":"https://daily.dev/sources/jfrog"},{"@type":"ListItem","position":3,"name":"The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results"}]} ```