Malicious NuGet packages with millions of downloads are targeting users everywhere
Multiple typosquatted packages discovered in NuGet packages
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cybersecurity researchers from Phylum recently discovered a malware campaign on the NuGet package manager for the .NET Framework, trying to trick people into infecting theirendpointswith a remote access trojan (RAT) called SeroXen.
The unnamed threat actors updated a malicious package called Pathoschild.Stardew.Mod.Build.Config, a typosquat of a legitimate package with a similar name - Pathoschild.Stardew.ModBuildConfig. If run, the package activates a PowerShell script, which downloads a file named x.bin (which is actually a Windows Batch script). This file builds and runs another PowerShell script which, ultimately, delivers the SeroXen RAT.
For typosquatting attacks to work, the victims need to be distracted, burnt out, or plain reckless. In this instance, the attackers went a little further to try and build legitimacy - they artificially inflated the download count. So, while the proper package has some 80,000 downloads, the malicious one has more than 100,000 downloads. That way, even the developers with a little more due diligence done might still be tricked into downloading the wrong package.
Off the shelf
SeroXen is described as off-the-shelf malware, costing $60 for a lifetime bundle. The fileless RAT combines the functions of Quasar RAT, the r77 rootkit, and the Windows command-line tool NirCmd, The Hacker News reports. According to Trend Micro’s analysis, SeroXen offers a “comprehensive list” of features, with some standout ones including a Windows Defender-guaranteed bypass for both scan time and runtime; FUD scan time and runtime evasion against most antivirus engines; hidden Virtual Network Computing (hVNC), and full modern Windows support.
“The discovery of SeroXen RAT in NuGet packages only underscores how attackers continue to exploit open-source ecosystems and the developers that use them,” Phylum said.
While the researchers did not elaborate on who the targets might be, they did say that the same account that uploaded SeroXen uploaded six other packages, four of which impersonated libraries for different crypto services.
ViaThe Hacker News
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
NYT Strands today — hints, answers and spangram for Sunday, November 10 (game #252)
