Malicious NuGet Packages Pose as Nethereum, Steal Crypto Wallet Keys

A recent GBHackers on Security report reveals a sophisticated supply-chain attack against the NuGet registry, where malicious packages impersonate the Nethereum library through a homoglyph typosquat named Netherеum[.]All. The package, first published on 16 October 2025, appeared identical to Nethereum at a casual glance, thanks to a Cyrillic “e” (U+0435) in its name, exploiting NuGet’s permissive Unicode rules.

NuGet removed the package and suspended the publisher account (nethereumgroup) on 20 October 2025, after the four-day window gave attackers time to potentially compromise environments. The hunters observed inflated downloads—11.6 million in total—to boost credibility and skew search results, with attackers using automated scripts to drive popularity.

The core malicious functionality resides in a method called EIP70221TransactionService[.]Shuffle, which uses a 44-byte XOR mask to reveal a C2 endpoint (solananetworkinstance[.]info/api/gads) and exfiltrate sensitive data via an HTTPS POST with a field named “message,” potentially including mnemonics, private keys, keystore JSON files, or signed transaction data.

Researchers note the package also masquerades as legitimate Nethereum references, aiding normal compilation and operation, and advise developers to rotate wallet secrets and adopt stricter dependency hygiene.