NuGet malware targets crypto wallets, OAuth tokens

Back Reversinglabs

NuGet malware targets crypto wallets, OAuth tokens

Reversinglabs • December 17, 2025

Share: View original

Highlighting an alarming trend, RL has discovered malicious packages that impersonate Nethereum — but copy functionality to enable attacks.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NuGet Malware Impersonates Nethereum to Steal Crypto Assets Malicious NuGet packages have been identified that mimic the Nethereum library, targeting crypto wallets and OAuth tokens. Users of .NET applications integrating these libraries are at risk of having their credentials and assets stolen. The malware exploits the functionality of legitimate packages to conduct its attacks. 2 sources 34

Extracted Entities

Attack Types (2)

Malware Supply Chain Attack

Platforms (2)

Nethereum NuGet