Malicious NuGet Package Steals Banking Credentials

A fake C# SDK on NuGet, "Sicoob.Sdk," was found stealing sensitive financial credentials and certificates from unsuspecting developers.

Security researchers have discovered a malicious package on the NuGet repository named "Sicoob.Sdk." The package impersonates a C# software development kit for Sicoob, a major Brazilian financial cooperative. According to security firm Socket, versions 2.0.0 through 2.0.4 contain hidden code designed to exfiltrate sensitive information from a developer's environment. The stolen data includes critical credentials like client IDs and PFX certificates, which are used for digital authentication and signing. The package acts as a trojan, tricking developers into compromising their own systems by installing what appears to be a legitimate tool.

This incident is a classic software supply chain attack, targeting developers to breach secure systems. By integrating the malicious package, developers unknowingly introduce a backdoor for attackers. The theft of PFX certificates is especially dangerous, as these files can be used to impersonate the owner, authorize transactions, and access secure financial services. This attack directly impacts developers using the NuGet ecosystem, particularly those building applications for Brazilian financial services. It highlights the critical need for organizations to scrutinize all third-party dependencies and verify their authenticity. This type of attack is part of a broader trend where threat actors exploit the trust developers place in open-source registries like NuGet to distribute malware.

This is a direct software supply chain attack targeting developers through a trusted package manager. It steals high-value financial credentials (PFX certificates), demonstrating a sophisticated threat that can lead to significant financial fraud.

Businesses using this malicious package could suffer direct financial loss through fraudulent transactions, credential theft, and reputational damage. It forces development teams to audit their codebase for the compromised dependency and revoke any stolen credentials, leading to significant operational costs.