A new report from Socket’s Threat Research Team has revealed a malicious NuGet package, Tracer.Fody.NLog, that masquerades as a legitimate logging integration for .NET projects but actually functions as a Stratis cryptocurrency wallet stealer.
The package, which impersonates the trusted Tracer. The Fody library and its maintainer have remained active on the NuGet Gallery since 2020, with around 2,000 downloads.
Typosquatting and Homoglyph Impersonation
The malicious package Tracer.Fody.NLog was uploaded under the alias csnemess, a one-letter variation of the real maintainer csnemes.
This subtle difference, along with a copied package description and a naming pattern consistent with legitimate Tracer packages, made it appear authentic to developers.
Upon analysis, researchers found that the included Tracer.Fody.dll file embedded deceptive identifiers using Cyrillic homoglyphs Unicode characters that resemble Latin letters.
Names such as Тrасer, Fоdy, and Guаrd look identical to their legitimate counterparts but contain hidden Cyrillic letters, allowing the malware to evade string-matching inspections.
This combination of typosquatting, impersonation, and homoglyph abuse enabled the malicious library to blend seamlessly with common .NET tracing and logging dependencies, such as Anotar. Fody and ToString.Fody, which is widely trusted across enterprise development pipelines.
Inside the Wallet-Stealing Code
Once integrated into a project, the malicious DLL intercepts calls to the helper method Guard.NotNull<T>.
When this function receives any object containing a WalletPassword property, it silently triggers background code that searches the default Stratis wallet directory at
%APPDATA%\StratisNode\stratis\StratisMain.It then reads all *.wallet.json files, captures their contents and associated passwords, and sends the stolen data to a threat actor-controlled C2 server at 176[.]113[.]82[.]163:4444 in Russia.
The exfiltration process operates stealthily without logs, prompts, or visible alerts, ensuring normal application behavior while leaking data in the background.
The same IP address has been linked to previous malicious NuGet packages, such as Cleary asyncExtensions, which targeted mnemonic and passphrase data used in blockchain wallets.
Passive scans identify the system as a Windows host under AS48347 (MTW-AS), still online as of December 2025.
Security researchers warn that this long-term persistence underscores the risks of open-source supply-chain attacks in .NET development.
Developers are urged to verify package maintainers and use advanced detection tools, such as Socket AI Scanner or Socket’s GitHub App, to identify malicious dependencies before deploying to production environments.
The incident underscores how trusted components such as IL weavers and logging adapters can be weaponized to exfiltrate wallet credentials, turning everyday developer utilities into covert data exfiltration channels.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
