CampaignPublished 17 Dec 2025

NuGet malware targets crypto wallets, OAuth tokens

Source AlienVault OTX General

Description

A malware campaign discovered on the NuGet package repository targets the cryptocurrency ecosystem by distributing 14 malicious packages impersonating legitimate crypto-related tools. These packages employ techniques such as homoglyphs, version bumping, and inflated download counts to appear trustworthy and evade detection. The malware aims to steal crypto funds by redirecting transactions and exfiltrating secrets, including OAuth tokens for Google Ads accounts. The campaign highlights the risks of software supply chain attacks, especially for projects relying on compromised dependencies. No known exploits in the wild have been reported yet, but the threat poses a significant risk to developers and organizations integrating these packages. The attack affects . NET developers using NuGet packages related to cryptocurrency and OAuth services. The severity is assessed as medium due to the potential confidentiality and financial impact, combined with moderate exploitation complexity. European organizations involved in blockchain development, fintech, and digital advertising are particularly at risk. Mitigation requires strict dependency vetting, use of package integrity verification, and monitoring of OAuth token usage.

Impact

The primary impact of this threat is the compromise of cryptocurrency wallets and OAuth tokens, leading to potential financial losses and unauthorized access to cloud services. For European organizations, especially fintech companies, blockchain developers, and digital marketing agencies, the theft of crypto funds or OAuth credentials can result in direct monetary loss, reputational damage, and regulatory scrutiny under GDPR and other data protection laws. The supply chain nature of the attack means that even organizations with strong internal security can be compromised through trusted dependencies, potentially affecting entire projects and their user communities. The redirection of crypto transactions undermines the integrity and availability of financial operations, while OAuth token theft can lead to broader cloud service compromises, data leakage, and fraudulent activities. The medium severity reflects the significant confidentiality and financial risks balanced against the need for user interaction and some technical sophistication to exploit the malicious packages.

Defensive guidance

European organizations should implement strict dependency management policies, including: 1) Employing automated tools to detect homoglyphs and suspicious package naming conventions in NuGet dependencies. 2) Verifying package integrity using cryptographic signatures and checksums before integration. 3) Monitoring and auditing OAuth token usage and permissions regularly to detect anomalies. 4) Restricting the use of third-party packages to those from verified and trusted publishers only. 5) Implementing runtime behavior monitoring to detect unusual process injections or network communications indicative of wallet or token theft. 6) Educating developers about supply chain risks and encouraging manual review of critical dependencies. 7) Utilizing private package repositories or mirrors with strict vetting to reduce exposure to public repository threats. 8) Applying least privilege principles to OAuth tokens and crypto wallet access to minimize potential damage. These measures go beyond generic advice by focusing on detection of specific attack techniques and enforcing strict supply chain hygiene.

Summary

In July 2025, a campaign was identified involving 14 malicious NuGet packages targeting the cryptocurrency ecosystem. These packages impersonated legitimate crypto-related tools by using homoglyphs—characters visually similar to legitimate package names—to deceive users. The attackers also employed version bumping and artificially inflated download counts to increase perceived legitimacy. The malware was categorized into three groups: wallet stealers that redirect or intercept cryptocurrency transactions to attacker-controlled wallets; crypto-funds stealers that exfiltrate private keys or secrets enabling unauthorized fund transfers; and Google Ads OAuth stealers that harvest OAuth tokens to gain unauthorized access to Google Ads accounts, potentially facilitating fraudulent advertising or further compromise. This campaign exemplifies a sophisticated software supply chain attack, exploiting the trust developers place in widely used package repositories like NuGet. The attack leverages multiple MITRE ATT&CK techniques, including masquerading (T1036.005), user execution (T1204.002), process injection (T1055), and credential access (T1552.001). While no active exploits have been reported, the presence of these packages in the ecosystem poses a latent risk to any project depending on them. The campaign underscores the importance of supply chain security in the .NET development environment, particularly for projects handling sensitive crypto assets or OAuth-based integrations.

Indicators of compromise

Hashes 265

03ff8f5352e42dbb0f2e60ae9bc36b27c35860b3
05a29102d2769834b87cf8505cf64fb910625d1e
0655cdd206703064b2dfdda44393295f4e380bec
08aeac51c5af03a3dd769d339fb8a4b08729a4de
0907e15fceae4ac81383ea576a44b71ed1a9643a
09618bc8f2dde467890403b5ad71ab8349dd7339
0a70ea53f4ade70ce2616522ffb601ee1778c0ea
0ad97d12add68d0e998d40d69c9e4b189f4a9588
0b267bc5cbba9a96b3c7ecf56222776fccf8d13e
0efe44b572d3fd481cb16a47dd3b7516c104d4d2

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 17 Dec 2025, 23:27 UTC

MITRE ATT&CK techniques9 from threat tags

Technical details

Indicators of compromise

Hashes 265

Community reviews

Related threats