{"id":1087,"date":"2026-05-29T10:42:10","date_gmt":"2026-05-29T10:42:10","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1087"},"modified":"2026-05-29T10:42:10","modified_gmt":"2026-05-29T10:42:10","slug":"malicious-sicoob-nuget-steals-banking-credentials-as-npm-packages-target-cloud-secrets","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1087","title":{"rendered":"Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets"},"content":{"rendered":"
\n
<\/a><\/div>\n

Cybersecurity researchers have discovered a malicious NuGet package that masquerades as a C# software development kit for Sicoob, one of Brazil’s largest cooperative financial systems, to siphon client IDs and PFX certificates.<\/p>\n

According to Socket<\/a>, versions 2.0.0 through 2.0.4 of \u00abSicoob.Sdk<\/a>\u00bb contain functionality to exfiltrate sensitive information, including PFX certificates that are used to authenticate businesses with the Sicoob banking network in order to automate banking operations, such as processing instant payments and generating dynamic Pix QR codes. The package is estimated to have been downloaded nearly 500 times.<\/p>\n

\u00abWhen a developer instantiates SicoobClient with a client ID, a PFX file path, and a PFX password, the package reads the PFX file from disk, Base64-encodes its contents, and sends the supplied client ID, PFX password, and encoded PFX data to a hardcoded third-party Sentry endpoint,\u00bb security researcher Kirill Boychenko said.<\/p>\n

In addition, the package is designed to capture raw Boleto API responses via a separate Sentry path. Boleto<\/a> is a popular cash payment method in Brazil for making online and offline purchases. This can potentially expose sensitive transaction details, payment status, amounts, due dates, identifiers, and payer or payee data.<\/p>\n

As a result, the stolen data could open the door to severe risks, as it can be abused by the threat actor to impersonate the victim’s Sicoob banking API integration, Socket added. Following responsible disclosure, the package has been blocked by NuGet. The profile behind the package, named \u00absicoob,\u00bb has also listed 11 other NuGet packages that have collectively racked up about 6,000 downloads.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The application security company also said the package was surfaced by Google Search AI Mode as a legitimate C# library for interacting with Sicoob banking APIs, thereby amplifying the malicious package to unsuspecting developers who may be searching for it.<\/p>\n

<\/p>\n

Another important aspect of the attack is the source-to-package mismatch between the linked GitHub repository<\/a> and the artifact distributed via NuGet. It’s suspected that the GitHub repository is designed to lend a veneer of legitimacy to the operation by keeping it clean, while the malicious data-stealing functionality is introduced only in the package uploaded to the registry.<\/p>\n

What’s more, the compromise of Sicoob API authentication material can also pose indirect risks to end users, as it could leak downstream financial data or enable payment abuse.<\/p>\n

Organizations that have installed \u00abSicoob.Sdk\u00bb are recommended to immediately remove the package, treat PFX material as compromised, replace exposed PFX certificates, rotate PFX passwords, and change or disable affected client IDs where applicable. It’s also advised to audit Sicoob authentication and API logs for signs of unusual activity.<\/p>\n

The development coincides with the discovery<\/a> of 14 malicious npm packages that typosquat well-known OpenSearch, ElasticSearch, DevOps, and environment-configuration libraries to harvest AWS credentials, HashiCorp Vault tokens, npm tokens, and CI\/CD pipeline secrets from the host environment using a purpose-built credential harvester that’s launched through a preinstall hook.<\/p>\n

\"\"<\/a><\/div>\n

Per the Microsoft Defender Security Research Team, the packages were published by a single threat actor named \u00abvpmdhaj\u00bb (\u00aba39155771@gmail.com\u00bb) on May 28, 2026. The names of the packages are below –<\/p>\n