Fake Nethereum NuGet Package Used Homoglyph Trick to Steal Crypto Wallet Keys

Cybersecurity researchers have uncovered a supply-chain attack on the NuGet package manager that uses Typosquats of Nethereum to steal wallet data. The malicious package Netherеum[.]All swaps the last occurrence of the letter “e” with the Cyrillic homoglyph “e” to look authentic, and its authors inflated download counts to crude 11.7 million claimed downloads to appear credible, according to Socket.

The package, uploaded on 16 October 2025 by a user named “nethereumgroup,” was taken down four days later for violating NuGet’s Terms of Use. The main payload decodes a C2 endpoint (solananetworkinstance[.]info/api/gads) and exfiltrates mnemonic phrases, private keys, and keystore data from victims. This follows a prior similar attempt earlier in the month with a package called “NethereumNet,” which has already been removed by the NuGet security team.

To mitigate such risk, users are urged to scrutinise publisher identity and watch for sudden download surges, while monitoring for anomalous network traffic.