14 Malicious NuGet Packages Found Stealing Crypto Wallets and Ad Data

ReversingLabs uncovered a supply-chain campaign on NuGet involving 14 malicious packages that impersonated popular libraries (e.g., "Netherеum.All") to steal crypto seed phrases and private keys, swap cryptocurrency transaction destinations for amounts over $100, and steal OAuth tokens (e.g., affecting Google Ads). The operators used homoglyphs, rapid version bumps, and artificially inflated download counts to appear legitimate; one author linked to prior theft-related packages (DamienMcdougal). Because these packages can be included in downstream projects, the campaign poses a significant risk to developers and end users, enabling broad financial theft and credential misuse.