Five Malicious NuGet Packages Target Developers with Credential and Crypto Wallet Stealer

May 6, 2026 · Original article ↗

Summary

Socket researchers found five malicious NuGet packages impersonating Chinese .NET libraries. The packages deliver an infostealer targeting browser credentials, crypto wallets, SSH keys, and files; about 65,000 downloads are reported, and the packages remain available.

Key points

The packages, published by NuGet account bmrxntfj, are IR.DantUI, IR.Infrastructure.Core, IR.Infrastructure.DataService.Core, IR.iplus32, and IR.OscarUI.
Each package combines a .NET Reactor-protected stealer with library code; its module initializer activates payload code when the DLL is loaded.
Researchers report 224 versions across the five package IDs, including 219 unlisted but fetchable versions, with frequent version rotation that can invalidate hash-based detections.
The stealer targets saved data from 12 browsers, five browser wallet extensions, eight desktop crypto wallets, as well as SSH keys, Outlook profiles, Steam credentials, and files in common user folders.
The reported C2 is dns-providersa2[.]com, with data staged at C:\ProgramData\Microsoft OneDrive\keys.dat before exfiltration.
The packages had accumulated about 64,784 downloads, potentially exposing developer workstations and CI/build systems that restored and loaded them.
Socket says all five packages remained available at publication and that it submitted takedown requests; it recommends checking dependency graphs, treating affected machines as compromised, and rotating accessible credentials.

Article Details

Attack Vectors: Five malicious NuGet packages impersonated Chinese .NET UI and infrastructure libraries and included .NET Reactor-protected infostealer payloads.
Loading a package DLL triggered its module initializer automatically, which used a JIT hook to decrypt method bodies and execute the payload.
The packages harvested browser credentials, cookies, session tokens, wallet data, SSH keys, Outlook profiles, Steam session data, and files from user directories, then sent collected data to the C2.
The payload used process injection capabilities and staged harvested material at C:\ProgramData\Microsoft OneDrive\keys.dat.
The publisher rotated package versions and hid most prior versions from public search while keeping them fetchable via direct, version-pinned installs.
Defensive Notes: Check project files and packages.lock.json for IR.DantUI, IR.Infrastructure.Core, IR.Infrastructure.DataService.Core, IR.iplus32, and IR.OscarUI at any version; treat machines that restored and loaded them as compromised.
Rotate credentials accessible from affected machines, including browser passwords, API keys, SSH keys, cryptocurrency wallet seeds, and cloud provider credentials.
Block or alert on DNS resolution of dns-providersa2[.]com and outbound connections to 62[.]84[.]102[.]85.
Alert on creation of C:\ProgramData\Microsoft OneDrive\keys.dat, suspicious Edge IElevator interface requests, and outbound requests with randomly generated X- plus three-letter headers from build or developer machines.
Search dependency registries for the shared Git commit hash efb675de4b3af3dac3c9cae91075fd7cc2f4f98e, the Iplusus NuGet tag, and git[.]justdotrip[.]com.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`1-you[.]njalla[.]no`	Nameserver listed for the primary C2 domain.
DOMAIN	`2-can[.]njalla[.]in`	Nameserver listed for the primary C2 domain.
DOMAIN	`3-get[.]njalla[.]fo`	Nameserver listed for the primary C2 domain.
DOMAIN	`dns-providersa2[.]com`	Primary C2 domain used for beaconing and exfiltration.
DOMAIN	`git[.]justdotrip[.]com`	Operator development infrastructure listed in package metadata; not observed as active C2.
DOMAIN	`justdotrip[.]com`	Parent domain associated with the operator development infrastructure.
IPV4	`47[.]100[.]60[.]237`	IP address resolving from the operator development infrastructure domain.
IPV4	`62[.]84[.]102[.]85`	C2 server IP address; outbound connections are recommended for alerting.
SHA256	`019e6c2cf58386039133981f3377b085fbd70c98ae8613c7c6a4f10a9f2d9824`	SHA-256 hash of the encrypted stage-2 resource in IR.iplus32 version 2.1.55.
SHA256	`34e2d63b5db7e24c808711c2ca0c0a42afde97a0086d7d81609110c002d18d7c`	SHA-256 hash of the encrypted stage-2 resource in IR.DantUI version 2.1.55.
SHA256	`596c453c9dbb7240f1ce05cc025496524ce7c538c23a9b2171174bf32b5691a1`	SHA-256 hash of the encrypted stage-2 resource in IR.OscarUI version 2.1.55.
SHA256	`8f7aa15c77bde94087bb74dfc072e25212797b313731b4cad0ded3e152268dcf`	SHA-256 hash of we4ftg.exe, the analyzed infostealer assembly.
SHA256	`b8543b2a1ad8862ebfef18924cf5444d2adfee996939963f4fc2748c582cf9a9`	SHA-256 hash of the encrypted stage-2 resource in IR.Infrastructure.Core version 2.1.55.
SHA256	`b8fa1b2fade45304c003909e375d2519ea447b498b7d93fe7c50db014d30f4fa`	SHA-256 hash of the encrypted stage-2 resource in IR.Infrastructure.DataService.Core version 2.1.55.
SHA256	`e1869d6571894f058dd4ab2b66f060628dc364ee8e29afbd2323c95e5002fb8e`	SHA-256 hash of s4.exe, a memory dump containing a live stealer execution from the campaign.
URL	`hxxps[:]//dns-providersa2[.]com/check`	C2 beacon and operator-validation endpoint.
URL	`hxxps[:]//dns-providersa2[.]com/upload`	Endpoint used to upload exfiltrated data.