Sophisticated Supply Chain Attack Targets Brazilian Banking SDK via Malicious NuGet Package A supply chain attack impersonating the official C# SDK for Sicoob, one of Brazil’s largest cooperative banking networks, was uncovered by researchers at Socket. The malicious NuGet package, Sicoob.Sdk (versions 2.0.0–2.0.4), contained hidden credential exfiltration logic designed to steal sensitive banking credentials and payment data. ### Key Details of the Attack - Timeline: The fraudulent package was published on May 5, 2026, and rapidly updated to version 2.0.4 by May 6, 2026, before being blocked following Socket’s abuse report. - Target: Sicoob serves 9 million members across 328 cooperatives and 5,219 service points in Brazil, making it a high-value target for financially motivated threat actors. - Deception Tactics: The package mimicked a legitimate .NET 8 SDK for Sicoob’s APIs, complete with a GitHub organization (Sicoob-Cooperativa) and clean-looking source code. However, the compiled DLL contained malicious logic absent from the public repository. - Exfiltration Mechanism: When developers initialized SicoobClient with a client ID, PFX file path, and password a standard workflow for mutual TLS banking integrations the DLL secretly base64-encoded the PFX certificate and transmitted it, along with the plaintext password and client ID, to a hardcoded Sentry telemetry endpoint (o4511335034847232.ingest.de.sentry.io). - Secondary Data Theft: The attack also captured raw boleto API responses, exposing transaction details, payer/payee information, due dates, and payment status. - Trigger Condition: The exfiltration only activated when isSandbox was set to false, meaning it targeted production environments using live credentials. ### Attacker Infrastructure & Exposure - The NuGet publisher account (sicoob) listed 12 Sicoob-branded packages, accumulating 484 total downloads. - The fraudulent GitHub organization (Sicoob-Cooperativa), created on May 4, 2026, had no verification, public members, or affiliation with the real Sicoob, whose official GitHub links to sicoob.com.br. - Google’s AI search briefly promoted Sicoob.Sdk as the recommended .NET integration path, increasing developer exposure. ### Broader Context This incident follows a February 2026 discovery of four malicious NuGet packages (NCryptYo, DOMOAuth2_, IRAOAuth2.0, SimpleWriter_), which exfiltrated ASP.NET Identity data and installed persistent C2 backdoors, totaling 4,500+ downloads. These campaigns highlight NuGet’s growing appeal to attackers using impersonation, typosquatting, and source-façade techniques to bypass developer trust. ### Indicators of Compromise (IOCs) - Malicious Package: Sicoob.Sdk (versions 2.0.0–2.0.4) - NuGet Publisher: sicoob - Exfiltration Host: o4511335034847232.ingest.de.sentry.io - Fraudulent GitHub Org: github.com/Sicoob-Cooperativa - Fraudulent Contributor: github.com/joaobcdev