Malicious NuGet Package Uses .NET Logging Tool to Steal Cryptocurrency Wallet Data

A malicious NuGet package, identified as Tracer.Fody.NLog, has been uncovered posing as a legitimate .NET tracing library. This package, released in 2020, had deceived developers and was downloaded approximately 2,000 times by imitating the well-known Tracer.Fody tool and its maintainer.

The attack utilized typosquatting and social engineering techniques, presenting itself under the user alias csnemess, which closely resembles the legitimate maintainer, csnemes. By replicating the original package's metadata and description, the attackers ensured minimal suspicion from casual observers.

This tactic allowed the malware to integrate seamlessly into development environments, targeting internal tools and CI pipelines. Analysts at Socket.dev identified this sophisticated threat, which specifically aims at cryptocurrency assets.

The package contains a routine designed to extract sensitive information from Stratis cryptocurrency wallets, lying dormant until specific conditions activate its malicious functions.

The impact of this campaign is significant due to the package's extended presence, potentially residing in various projects for over five years, collecting credentials. The attackers utilized a command-and-control server in Russia to gather the stolen wallet data, illustrating the calculated nature of the financial theft operation.

The core functionality of the malware exploits a common coding pattern by embedding itself within a generic helper method called Guard.NotNull. This method, frequently used by developers for argument validation, provided an ideal location for the malicious logic.

When the helper processes an object with a WalletPassword property, the malware activates. It uses reflection to extract the password and searches the victim's system for Stratis wallet files, particularly targeting the %APPDATA%\StratisNode\stratis\StratisMain directory.

Once located, the wallet.json files are captured, and essential keys are extracted and transmitted, along with the password, to a hardcoded IP address. The threat actors further obfuscated the code using homoglyphs, making manual code review challenging even for experienced developers.

This combination of obfuscation and silent execution allows the host application to appear normal while sensitive financial data is siphoned from compromised systems.

The attack underscores how trusted development tools can be weaponized, transforming routine dependency updates into significant security threats for organizations.

Based on reporting by Cyber Security News.