Experts have discovered a Trojan capable of rigging online live betting platforms

JFrog discovered Newtonsoftt.Json.Net, a NuGet Trojan mimicking the popular Newtonsoft.Json library.
Malware specifically targeted the backend of Digitain’s crash games, rigging results with inside knowledge of its codebase.
The problem was quickly resolved but the attackers remain unidentified

JFrog security researchers discovered a single Trojan targeting a specific company, while letting everyone else who was infected escape unscathed.

Named Newtonsoftt.Json.Net, the Trojan is a typosquatted NuGet package variant of the very popular JSON library called Newtonsoft.Json. The legit package is one of the most used code libraries in the world of .NET programming, necessary for almost every project in existence. It is a small piece of software that helps .NET applications read, understand and exchange data between different systems.

According to JFrog, someone published a nearly identical package, copied the real author’s name and license, and made it work as expected. For almost everyone who installed it, it worked completely normally. However, for developers working on Digitain’s crash-game backend, it’s a completely different story.

Rig the games

Digitain is an Armenian software company that provides sports betting and online gaming software platforms to gaming companies around the world.

On the infected machine running Digitain’s real crash game code, the malware swaps a fake number instead of a fair number, using a formula based on date and time.

This means that the results of the gambling game are rigged, allowing attackers to know in advance which rounds are being manipulated and place their bets accordingly.

The malware also sets up a private confirmation channel to report each trick trick, allowing attackers to know whether the cheat code still works or not.

JFrog did not identify the attackers, but stressed that it was most likely an insider.

Apparently, only someone with extensive knowledge of Digitain’s codebase (e.g. a current or former employee, or contractor) could have created such an exploit, as it required knowledge of the exact name of the internal function of Digitain’s game engine that decides the outcome of the game crash.

The researchers contacted Digitain on July 7, 2026 and were informed two days later that the problem had already been reported to the team and, in the meantime, resolved.