Malicious NuGet Packages Attacking ASP.NET Developers to Steal Login Credentials
## Cybersecurity: Malicious NuGet Packages Targeting ASP.NET Developers
Cybersecurity: Malicious NuGet Packages Targeting ASP.NET Developers
A recent supply chain attack has been identified, targeting ASP.NET developers with four malicious NuGet packages designed to steal login credentials and establish persistent backdoors in web applications.
Packages Involved: NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_ Publication Date: Between August 12 and 21, 2024 Threat Actor: Operated under the username "hamzazaheer" Downloads: Over 4,500 downloads collectively
The attack deploys deception tactics, where NCryptYo masquerades as a cryptography library similar to the legitimate NCrypto package. The package's DLL, named NCrypt.dll, mimics Windows’ native cryptography provider, and its namespace resembles Microsoft’s cryptography APIs. A static constructor is executed upon assembly load, deploying a hidden proxy on localhost port 7152, relaying traffic to an external server controlled by the attacker.
Other packages, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_, share a byte-identical hardcoded authentication token encoded using GZip compression and custom Base64 substitutions, confirming they originate from the same operator. These packages collect ASP.NET Identity data and route it to the attacker's server.
The package's DLL, named NCrypt.dll, mimics Windows’ native cryptography provider, and its namespace resembles Microsoft’s cryptography APIs.
NCryptYo utilizes JIT compiler hijacking to obscure its malicious behavior. The .NET runtime typically compiles methods just before execution; however, this package replaces that process with a hook, decrypting the malicious code at runtime, thus evading static analysis. The DLL is protected by .NET Reactor obfuscation, including a 14-day expiry timer and anti-debugging checks.
Verify package names, author identities, and download histories before installation. Monitor network traffic for unusual activity on localhost ports. Implement automated CI/CD pipeline scanning to detect obfuscation markers, static constructor misuse, and embedded encrypted payloads.
Security teams should ensure these measures are in place to mitigate the risk of malicious package installations and protect sensitive data from unauthorized access.
Based on reporting by Cyber Security News.