This threat involves five malicious NuGet packages published under the account 'bmrxntfj' that impersonate Chinese .NET UI and infrastructure libraries. The packages contain payloads protected by .NET Reactor, grafted onto decompiled legitimate code to evade detection. The campaign uses version rotation with 219 of 224 versions unlisted but fetchable, complicating hash-based detection. The infostealer targets credentials from 12 browsers, 8 desktop cryptocurrency wallets, and 5 browser wallet extensions, exfiltrating stolen data to a newly registered C2 domain. The payload activates through .NET module initializers and hooks into the CLR JIT compiler, enabling cross-platform infection including Linux and macOS environments. With roughly 65,000 downloads, this supply chain attack risks compromising developer workstations and CI/CD build servers. No vendor advisory or patch information is currently available.

The malware can steal sensitive information including browser credentials, cryptocurrency wallets, SSH keys, and local files from infected systems. It targets a broad range of browsers and crypto wallets, increasing the potential impact on users involved in software development and cryptocurrency management. The campaign's use of version rotation and unlisted package versions complicates detection and mitigation efforts. Cross-platform infection capability extends the threat beyond Windows to Linux and macOS infrastructure, potentially affecting diverse development environments. The high number of downloads indicates significant exposure and risk to developer workstations and CI/CD pipelines.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, organizations should audit their NuGet package dependencies for suspicious or typosquatted packages, especially those published under the account 'bmrxntfj'. Remove or block these malicious packages and monitor for any signs of compromise related to browser credentials, crypto wallets, and SSH keys. Employ supply chain security best practices such as verifying package integrity and using trusted sources. Since the campaign uses version rotation and unlisted versions, rely on behavioral detection and threat intelligence indicators (e.g., known malicious domains and hashes) to identify infections.