JFrog has uncovered a Trojan embedded in a counterfeit NuGet package named Newtonsoft.Json.Net, disguised as the popular Newtonsoft.Json library. This malicious package was aimed at the server side of a crash game internally referred to as FG-Crash, developed by the Armenian software provider Digitain.
According to JFrog, the malicious code altered the round results based on a formula tied to the date and time. This manipulation allowed attackers to predict the rigged rounds and place bets accordingly.
JFrog identified seven versions of the package across three generations, available for download from August to October 2025. The later versions transmitted the results of the manipulated rounds to an external server, providing attackers with a confirmation channel for the exploit's effectiveness.
While JFrog did not identify the attackers, they pointed to a likely insider, as the exploit required knowledge of the exact name of an internal function within Digitain's game engine. Researchers contacted Digitain on July 7, and by July 9, the company reported that it was already aware of the issue and had resolved it. However, Digitain did not clarify whether the package was executed on their operational servers, leaving the true extent of the incident unknown.