Malicious NuGet Packages Target ASP.NET Developers to Steal Login Credentials
Recent investigations have identified malicious NuGet packages masquerading as legitimate developer tools targeting ASP.NET projects. These packages are designed to steal identity credentials and backdoor applications by establishing a localhost proxy.
Recent investigations have identified malicious NuGet packages masquerading as legitimate developer tools targeting ASP.NET projects. These packages are designed to steal identity credentials and backdoor applications by establishing a localhost proxy.
Four packages, published between August 12–21, 2024, by a user named "hamzazaheer," have accumulated over 4,500 downloads. The primary goal of this campaign is to intercept ASP.NET Identity authorization flows, exfiltrate user data, and inject unauthorized access rules into applications.
The main package, NCryptYo, impersonates a cryptography library through typosquatting of the legitimate NCrypto package. Instead of providing encryption functionalities, it deploys an obfuscated dropper. This package, along with DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_, forms a coordinated attack strategy against ASP.NET developers.
NCryptYo is particularly deceptive as it provides a public API with Encrypt and Decrypt methods that return null, while executing malicious logic using JIT-time decryption and runtime hooks. VirusTotal analysis shows only 1 out of 72 vendors detecting NCrypt.dll as malicious, highlighting the challenges of detecting heavily obfuscated .NET malware.
Upon being referenced in a project, NCryptYo’s static constructor executes during assembly load, installing JIT compiler hooks to decrypt payloads and deploy a second-stage binary. The package mimics legitimate cryptography components, using the name NCrypto and DLL filename NCrypt.dll , similar to Microsoft's cryptography APIs.
Recent investigations have identified malicious NuGet packages masquerading as legitimate developer tools targeting ASP.NET projects.
This second-stage component establishes a local proxy on https://localhost:7152. It serves as an intermediary between the malicious NuGet packages and external command-and-control infrastructure. NCryptYo lacks visible networking code, relying on the hidden payload and local tunnel to manage traffic for companion packages.
The packages DOMOAuth2_ and IRAOAuth2.0 are integrated into ASP.NET Identity flows, extracting sensitive authentication data. DOMOAuth2_ uses an IServiceCollection extension to exfiltrate user GUIDs and permissions. All requests are sent to https://localhost:7152/api/auth/ using a hardcoded attacker credential.
IRAOAuth2.0 mirrors the same exfiltration endpoints, with inlined attacker tokens in every request.
SimpleWriter_ provides file write and process execution functionalities under the guise of HTML-to-PDF conversion. Calls to ConvertHtmlToPDF communicate with the localhost proxy, writing arbitrary content to disk and executing hidden processes (e.g., wkhtmltopdf.exe).
This infrastructure allows the threat actor to manipulate the applications shipped by developers, with the localhost proxy and C2 channel continuing operations in production environments. This setup streams authorization data off-site and can grant unauthorized access dynamically.
Based on reporting by GBHackers.