Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library

Summary

A trojanized NuGet package, 'Newtonsoftt.Json.Net,' was found to rig live game results on Digitain. It functions normally for most users but targets Digitain's FG-Crash betting game, exfiltrating rigged results. Developers are advised to remove the package and block C2 addresses.

Key Takeaways

1. A trojanized NuGet package named "Newtonsoftt.Json.Net" was discovered, designed to rig live game results on Digitain.
2. The package masquerades as the legitimate Newtonsoft.Json library and has been downloaded approximately 1,200 times.
3. The malware specifically targets Digitain's FG-Crash betting game, exfiltrating rigged results to an attacker-controlled server.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents technical details about a cybersecurity threat, citing researchers and their findings. It avoids sensationalism and focuses on factual reporting of the discovered malware and its mechanisms. The information is presented objectively, with clear explanations of the technical aspects.

Bias assessment: Technical Reporting. The article's primary focus is on the technical details of a cybersecurity threat. It reports on the findings of security researchers without adopting a particular political or social stance. The language is objective and informative, aiming to educate the reader about the discovered malware.

Note: This article details a technical cybersecurity threat. While informative, it's recommended to cross-reference with official security advisories for comprehensive understanding and mitigation.

Credibility flag: Technical, Verify

Claimed Facts (7)

• This is a direct statement of fact about the discovery and the nature of the malware.
• This provides specific, verifiable details about the published versions of the malicious package.
• This is a quantifiable statistic presented as a fact regarding the package's usage.
• This states a factual action taken regarding the package's visibility on the NuGet repository.
• This provides specific technical details about the malware's composition and publication timeline.
• This identifies the specific entity targeted by the malware.
• This reports on Digitain's official response to the discovered threat.

Opinions (6)

• The word 'notable' introduces a subjective assessment of the package's characteristics.
• While attributed to a source, the phrasing 'can only succeed' implies a degree of interpretation and analysis rather than a purely objective fact.
• The interpretation of the author's 'iterative hardening' and the conclusion about 'accidental clean build' are analytical opinions.
• The use of 'only' suggests a definitive statement about the malware's activation, which is an analytical conclusion.
• The phrase 'exactly what makes this...so effective' is a subjective assessment of the attack's efficacy.
• Statements about the 'sole purpose' and what 'may not even notice' are interpretations of the malware's intent and impact.

Claims (7)

• While presented as fact, the term 'masquerades' implies intent and deception, which is an interpretation of the package's design.
• The specific header 'theperfectheist2025' sounds like a potentially fabricated or overly dramatic detail, though attributed to JFrog.
• The description of 'sidestep detection' and 'malicious functionality is fired' uses anthropomorphic language for code, which can be seen as a slight embellishment.
• The phrase 'masquerading it as telemetry data' implies a deliberate deception strategy that, while possible, is an interpretation of the code's function.
• While likely true, the statement about 'rigging strategy' and 'exfiltration path' being the primary changes is an analytical conclusion that could be debated.
• The conclusion that the author 'had access to FG-Crash's source code' is an inference based on the leaked URL, not a direct fact.
• The use of 'only' twice in this statement, while likely technically accurate, can be seen as a strong, definitive claim that might oversimplify the malware's potential interactions.

Key Sources

• The Hacker News — Media
• MagicalPuff96 — Package Owner
• JFrog — Cybersecurity Research Firm
• Guy Korolevski — JFrog security researcher
• Digitain — Online Betting Platform Operator