5-Year Threat: Malicious NuGet Package Used Homoglyphs and Typosquatting to Steal Crypto Wallets

A malicious NuGet package masquerading as a popular .NET logging tool has been caught stealing cryptocurrency wallet data for over five years. The package, Tracer.Fody[.]NLog, evaded detection by using homoglyphs and typosquatting to fool developers into embedding it in their build pipelines, and was discovered by the Socket Threat Research Team.

It targets the .NET ecosystem with a layered disguise, remaining dormant since its publication in 2020 and accumulating roughly 2,000 downloads while quietly siphoning credentials to a hardcoded C2 address, 176.113.82[.]163. The attackers used typosquatting by publishing as csnemess, a near-identical clone of csnemes, and blended in visually identical Cyrillic characters to conceal key identifiers such as Tracer[.]Fody and Guard.

Once installed, the malware hooks a function named Guard[.]NotNull<T> and silently exfiltrates data from the Stratis cryptocurrency wallet directory under %APPDATA%\\Stratis Node\\stratis\\Stratis Main. The investigation linked this infrastructure to a previous attack involving Cleary[.]AsyncExtensions, which used the same C2 IP address and homoglyph techniques to steal passphrases. according to Socket Threat Research Team