A Single Extra “t” in a NuGet Package Allow Attackers to Manipulate Results

Cybersecuritynews •Tushar Subhra Dutta • July 22, 2026

A malicious NuGet package used a single extra letter to hide in plain sight, turning a familiar software dependency into a betting-fraud tool. The package, Newtonsoftt.Json.Net, copied the appearance of the widely used Newtonsoft.Json library while carrying code designed to alter game outcomes. The campaign relied on typosquatting, a tactic that exploits small spelling mistakes made […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NuGet Typosquatting Attack Rigging Digitain Game Results A malicious NuGet package named 'Newtonsoftt.Json.Net' was discovered, targeting the Digitain betting platform by rigging game results. The package, which mimicked the legitimate Newtonsoft.Json library, was downloaded around 1,200 times before being removed. It specifically affected systems running Digitain's FG-Crash betting game, introducing randomized delays to avoid detection while exfiltrating altered game outcomes to an attacker-controlled server. The malware's progression included increasing obfuscation and sophisticated rigging strategies. Digitain has acknowledged the issue and implemented corrective measures. Developers are advised to remove the package and block the command and control (C2) address. This incident marks a notable evolution in supply chain attacks, focusing on targeted manipulation rather than broad data theft. 3 sources 69

Extracted Entities

A Single Extra “t” in a NuGet Package Allow Attackers to Manipulate Results

The full story

Extracted Entities

Attack Types (1)

Domains (1)

MITRE ATT&CK (1)

Platforms (1)