Trojanized Newtonsoft.Json Fork Used to Rig Online Betting Game Results
Malicious NuGet package specifically targets Digitain's crash-game backend.
1An Unconventional Software Attack
Security researchers discovered a fake library named 'Newtonsoftt.Json.Net' in the NuGet repository. Unlike typical data-stealing package registry attacks, this trojanized fork was designed to manipulate live game results on Digitain betting platform. The package masquerades as a functional fork of the original Newtonsoft.Json library.
2Targeted Attack Mechanism
The package's uniqueness lies in its specific targeting. While functioning normally for other users, it only exhibits malicious behavior on systems running Digitain's FG-Crash game backend method. The attack activates with a random delay when the JsonConvert.DefaultSettings property is assigned.
3Three Generations of Malicious Code
The seven versions published between August and October 2025 contain three generations of malicious code. The first generation only performed local rigging, while the second added data exfiltration. The final generation dropped code obfuscation, suggesting the attacker accidentally published a clean build.
4Access to Digitain's Internal Resources
Package metadata leaks Digitain's internal repository URL across all versions, indicating the attacker had access to FG-Crash's source code. This shows the attacker thoroughly understood the platform's workings and designed the manipulation accordingly.
5A Stealthy Threat
The attack's most dangerous aspect is its normal operation for non-targeted users. Developers who accidentally install the package might not notice any malicious behavior. The trojan contains no credential theft or lateral movement capabilities, focusing solely on compromising game integrity.
6Mitigation Measures and Impact
Experts recommend developers remove the fake package, block the C2 address, and pin Newtonsoft.Json to a known secure version. Digitain stated they're aware of the issue and have taken resolution steps, but the full extent of exposure remains unknown.
Original article: The Hacker News — Sahte Newtonsoft.Json Paketi ile Oyun Sonuçları Manipüle Edildi