Socket Uncovers Malicious NuGet Typosquat “Netherеum.All” Exfiltrating Wallet Keys via Solana-Themed C2

According to Socket’s Threat Research Team, researchers uncovered an active homoglyph typosquat on NuGet impersonating the Nethereum project, a widely used .NET library for Ethereum. The malicious package, Netherеum[.]All, swapped a Latin “e” for a Cyrillic lookalike (U+0435) to bypass casual inspection and hide a wallet exfiltration routine within legitimate-looking code.

The campaign is described as part of a broader trend of Unicode-based supply chain attacks on open-source registries, with the used C2 endpoint decoded from an XOR-obfuscated string to https://solananetworkinstance[.]info/api/gads. When activated, the code posts sensitive wallet data in a field named “message” via HTTPS, enabling the exfiltration during normal wallet operations such as importing mnemonics or signing transactions.

The malicious package was published under the username nethereumgroup on 16 October 2025, and NuGet search results allegedly showed 11.6 million total downloads soon after publication, described as a hallmark of scripted download inflation. The investigation linked Netherеum[.]All to an earlier malicious package named NethereumNet, published by the same actor using the aliases nethereumgroup and NethereumCsharp, suggesting a coordinated supply chain intrusion campaign.