Malicious NuGet Packages Steal Browser Credentials, SSH Keys, and Crypto Wallets

Gbhackers •Mayura Kathir • May 7, 2026

Malicious NuGet packages are quietly stealing browser credentials, SSH keys, and cryptocurrency wallet data from developer machines and CI/CD infrastructure, with a particular focus on Chinese .NET ecosystems. The campaign blends legitimate-looking UI and infrastructure libraries with a heavily protected infostealer payload, making it hard for developers and traditional security tools to spot. Packages IR.DantUI, IR.OscarUI, IR.Infrastructure.Core, IR.Infrastructure.DataService.Core, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious NuGet Packages Target Chinese Developers, Steal Sensitive Data Five malicious NuGet packages were discovered targeting developers in the Chinese .NET ecosystem. The packages, published under the account bmrxntfj, impersonate legitimate libraries and have accumulated around 65,000 downloads. They deploy a sophisticated infostealer that targets browser credentials, SSH keys, and cryptocurrency wallets. The attack leverages extensive version manipulation to evade detection, with 219 out of 224 versions marked as 'listed: false'. The primary command-and-control domain for the stolen data is dns-providersa2.com, registered on March 12, 2026. Cybersecurity researchers have submitted takedown requests to NuGet's security team, but the packages remain active as of the latest reports. Developers are advised to use legitimate libraries and rotate credentials from potentially compromised systems. 3 sources 77

Extracted Entities

Malicious NuGet Packages Steal Browser Credentials, SSH Keys, and Crypto Wallets

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (1)

Platforms (1)