The Socket Threat Research Team has identified a sophisticated typosquatting attack within the NuGet ecosystem. A malicious package, Tracer.Fody.NLog, has been found impersonating the popular and legitimate Tracer.Fody library. By mimicking the naming convention of the original author, the attacker (using the handle csnemess) aims to deceive developers into integrating a silent cryptocurrency wallet stealer into their production environments.

How the Attack Works:

Typosquatting: The package uses a name nearly identical to the official library to catch developers making accidental typos during installation.

Silent Exfiltration: The malicious code is embedded within standard helper functions, allowing it to bypass basic code reviews.

Targeted Theft: It specifically scans for Stratis cryptocurrency wallet files (*.wallet.json) and attempts to exfiltrate them, along with passwords, to a remote server.

Immediate Actions Required:

Audit Dependencies: Check all .csproj and packages.config files for any reference to Tracer.Fody.NLog.

Remove & Purge: If found, remove the reference immediately and purge your local NuGet cache.

Rotate Credentials: If you have used this package, consider all local wallets and environment variables compromised.

I have developed a custom PowerShell scanner to automate this detection and removal process. You can find the source in the [CODE] section of this deck.

Source: https://socket.dev/blog/malicious-nuget-package-typosquat...

CRITICAL: 8M Users' AI Conversations Harvested by "Privacy" Extensions
TL;DR: Urban VPN and related Chrome/Edge extensions silently exfiltrate your ChatGPT, Claude, and Gemini conversations to data brokers. Built a cross-platform detector - check the CODE section.
The Threat
Koi Security discovered 8 "Featured" browser extensions running a massive surveillance op. They override fetch() and XMLHttpRequest to intercept ALL AI platform traffic - even when disconnected.
Targeted Platforms:
ChatGPT • Claude • Gemini • Copilot • Perplexity • DeepSeek • Grok • Meta AI
Attack Timeline:

July 9, 2025: v5.5.0 silently added harvesting via auto-update
Data exfiltrated to analytics.urban-vpn.com
8M+ users affected across Chrome/Edge

The Scanner
Built a multi-platform detector (Windows/macOS/Linux) that scans for all 8 malicious extension IDs. Zero dependencies, completely offline.
→ Get the scanner in my CODE section
Malicious Extension IDs:

eppiocemhmnlbhjplcgkofciiegomcon - Urban VPN (6M users)
pphgdbgldlmicfdkhondlafkiomnelnk - 1ClickVPN (600K)
Plus 6 more variants (see scanner output)

What Gets Stolen
Every prompt, every response, conversation metadata, timestamps. Medical questions, financial details, proprietary code - all sold for "marketing analytics."
Mitigation

Grab the scanner from My CODE section
Uninstall any flagged extensions
Assume July 2025+ AI conversations are compromised

Source: Koi Security Research

Stay paranoid. Review your extensions.