Betting Trojan Disguises Stolen Round Results as Legitimate Seq Logging Traffic

This package impersonates the widely used Newtonsoft.Json library while quietly shipping a modified fork that targets Digitain’s FG‑Crash betting backend.

For most developers, the package behaves like a fully functional JSON framework.

However, on Digitain’s infrastructure it silently rigs crash-game rounds and, in later generations, exfiltrates those manipulated results to an attacker-controlled host that mimics Seq logging traffic.

The typosquat is carefully engineered to pass as legitimate Json.NET.

Metadata claims the official author, points to the real project URL, uses the Json.NET branding, and adopts a plausible 11.0.x version line that blends naturally into dependency graphs.

Under lib/net8.0/, NuGet auto-references three assemblies: a trojanized fork of Newtonsoft.Json, a payload DLL, and the Harmony runtime-patching library, ensuring the malicious code loads whenever the JSON library is used.

Betting Trojan Round Spoofing

The trigger is a booby-trapped JsonConvert.DefaultSettings setter that replaces the host’s resolver with the attacker’s and schedules a delayed Harmony patch, so the application appears healthy during startup.

At the same time, the backdoor activates minutes or hours later.

Across versions, Harmony always hooks GenerateGameResult, but the rigging strategy evolves, early builds rewrite IL to swap crash coefficients via deterministic lookup tables keyed by time, while later builds simplify to a postfix that overwrites the method’s return value based on month, day-of-week, week-of-month, and a special profile around 22:00 UTC.

The path, header, and event schema imitate a Seq logging-ingest endpoint, allowing outbound POSTs to blend in with normal application logging in environments that already rely on Seq.

This makes the fraud traffic hard to distinguish from legitimate observability data unless defenders specifically hunt for the suspicious IP and API key.

The attack is narrowly scoped, it does not steal credentials or move laterally, but instead focuses on manipulating the integrity of Digitain’s crash-game results for financial gain.

The attacker benefits from a pre-known schedule of rigged rounds, enabling preferential payouts or guaranteed wins that are invisible in aggregate because only a bounded number of rounds are patched before Harmony unhooks itself.

Other developers who installed the typosquatted package likely see only a normal JSON library, never realizing they shipped malware into production because the payload activates solely in environments exposing the targeted game-logic type.

JFrog responsibly disclosed the issue to Digitain, which confirmed the problem had already been identified and resolved. However, details about production exploitation remain unknown.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.