Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A malware campaign discovered on the NuGet package repository targets the cryptocurrency ecosystem by distributing 14 malicious packages impersonating legitimate crypto-related tools. These packages employ techniques such as homoglyphs, version bumping, and inflated download counts to appear trustworthy and evade detection. The malware aims to steal crypto funds by redirecting transactions and exfiltrating secrets, including OAuth tokens for Google Ads accounts. The campaign highlights the risks of software supply chain attacks, especially for projects relying on compromised dependencies. No known exploits in the wild have been reported yet, but the threat poses a significant risk to developers and organizations integrating these packages. The attack affects . NET developers using NuGet packages related to cryptocurrency and OAuth services. The severity is assessed as medium due to the potential confidentiality and financial impact, combined with moderate exploitation complexity. European organizations involved in blockchain development, fintech, and digital advertising are particularly at risk. Mitigation requires strict dependency vetting, use of package integrity verification, and monitoring of OAuth token usage.

In July 2025, a campaign was identified involving 14 malicious NuGet packages targeting the cryptocurrency ecosystem. These packages impersonated legitimate crypto-related tools by using homoglyphs—characters visually similar to legitimate package names—to deceive users. The attackers also employed version bumping and artificially inflated download counts to increase perceived legitimacy. The malware was categorized into three groups: wallet stealers that redirect or intercept cryptocurrency transactions to attacker-controlled wallets; crypto-funds stealers that exfiltrate private keys or secrets enabling unauthorized fund transfers; and Google Ads OAuth stealers that harvest OAuth tokens to gain unauthorized access to Google Ads accounts, potentially facilitating fraudulent advertising or further compromise. This campaign exemplifies a sophisticated software supply chain attack, exploiting the trust developers place in widely used package repositories like NuGet. The attack leverages multiple MITRE ATT&CK techniques, including masquerading (T1036.005), user execution (T1204.002), process injection (T1055), and credential access (T1552.001). While no active exploits have been reported, the presence of these packages in the ecosystem poses a latent risk to any project depending on them. The campaign underscores the importance of supply chain security in the .NET development environment, particularly for projects handling sensitive crypto assets or OAuth-based integrations.

Detailed information about NuGet malware targets crypto wallets, OAuth tokens. Get real-time updates, technical details, and mitigation strategies.

NuGet malware targets crypto wallets, OAuth tokens - Live Threat Intelligence - Threat Radar | OffSeq.com

NuGet malware targets crypto wallets, OAuth tokens

Threats Tagged 'version bumping'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'version bumping'

Lead Pen Test Professional