# Malicious Sicoob NuGet Package Steals Banking Credentials in Latest Supply Chain Attack


Cybersecurity researchers have discovered a sophisticated supply chain attack targeting developers in Brazil's financial sector. A malicious NuGet package masquerading as an official C# SDK for Sicoob, one of Brazil's largest cooperative financial institutions, was designed to harvest sensitive banking credentials and encryption certificates from unsuspecting developers.


According to security researchers at Socket, the compromised package—published under the name "Sicoob.Sdk"—affected versions 2.0.0 through 2.0.4 and contained obfuscated code that exfiltrated client IDs and PFX certificates used for API authentication. The discovery underscores a troubling trend: attackers increasingly target package managers as vectors to infiltrate enterprise infrastructure, particularly in the financial services sector.


## The Threat


The malicious Sicoob.Sdk package was designed with a specific objective: extract authentication credentials that would grant attackers direct access to Sicoob's banking APIs. The attack vector worked as follows:


  • Social engineering through naming: The package used a legitimate-sounding name ("Sicoob.Sdk") that closely resembled official documentation and SDKs developers would expect from the financial institution
  • Credential harvesting: The malware targeted PFX certificates—password-protected files that contain private keys used for mutual TLS authentication with banking APIs
  • Client ID extraction: In addition to certificates, the package harvested client identifiers, which when combined with stolen credentials, provide complete API access
  • Obfuscated delivery: The malicious code was obfuscated to evade static analysis and automated security scanning tools

    • Developers who installed the affected versions likely downloaded the package believing they were obtaining the legitimate SDK needed to integrate with Sicoob's services. Once installed in a development environment, the malware would execute upon package import, silently exfiltrating credentials to attacker-controlled servers.


    ## Background and Context: Supply Chain Attacks on Package Managers


    This incident is not an isolated event. Package managers—repositories like NuGet, npm, PyPI, and Maven—have become prime targets for sophisticated attackers seeking to compromise large numbers of organizations with a single malicious upload.


    Why package managers are attractive targets:


  • Trust asymmetry: Developers often trust packages within official repositories, assuming automated vetting prevents malicious code
  • Scale: A single malicious package can reach thousands of organizations across different industries
  • Persistence: Once installed as a dependency, malware operates within trusted environments with elevated privileges
  • Financial sector visibility: Banking and fintech companies are high-value targets because stolen credentials provide direct access to critical infrastructure

    • Previous attacks on package managers include:


    | Attack | Year | Package Manager | Impact |

    |--------|------|-----------------|--------|

    | XcodeGhost | 2015 | Unofficial iOS SDK | Modified apps for 100M+ users |

    | ua-parser.js | 2021 | npm | Crypto mining malware in 70M+ downloads |

    | SolarWinds | 2020 | Custom (not public) | Nation-state supply chain attack |

    | Dependency Confusion | 2021 | npm/PyPI | Cross-organization credential theft |


    ## Technical Details: How the Attack Worked


    The Sicoob.Sdk malware employed several technical mechanisms to remain undetected:


    ### Obfuscation and Evasion


    The package used code obfuscation techniques to disguise its malicious functionality:

  • String encryption: File paths and exfiltration URLs were encrypted within the binary
  • Reflection-based execution: The malware used .NET reflection APIs to dynamically load and execute code, avoiding static analysis detection
  • Delayed execution: The credential-stealing payload may have waited for specific conditions before exfiltrating data, complicating detection during testing

    • ### Credential Discovery and Extraction


    Once installed, the malware performed several actions:


    1. Certificate enumeration: Scanned the host system for PFX certificate files commonly stored in development directories

    2. Environment variable scanning: Searched for banking API credentials stored in environment variables or configuration files

    3. Keystore access: Attempted to access .NET credential stores where developers might have cached login information

    4. Exfiltration: Transmitted harvested credentials to remote command-and-control infrastructure


    ### Camouflage as Legitimate SDK


    The package included authentic-looking SDK components to further evade detection:

  • Valid NuGet package metadata matching Sicoob's legitimate naming conventions
  • Partial implementation of banking APIs to provide limited functionality if analyzed
  • Proper version numbering to appear as an update to legitimate versions

    • ## Who Was Affected?


    The primary victims of this attack were:


  • Fintech developers in Brazil building applications that integrate with Sicoob's banking network
  • Software development teams at companies offering banking services to Sicoob customers
  • Integration partners implementing payment processing or account management solutions

    • The attack's reach extended beyond individual developers to organizations with multiple development environments. A single installation in a shared development network could expose credentials for entire engineering teams.


    ## Implications for Organizations


    ### Direct Risk: Unauthorized API Access


    Stolen PFX certificates and client IDs provide attackers with the ability to:

  • Initiate fraudulent transactions on behalf of compromised accounts
  • Access customer financial data through legitimate API endpoints
  • Create persistent backdoors by registering additional credentials within the system
  • Conduct targeted fraud against high-value accounts identified through API access

    • ### Secondary Risk: Credential Compromise Across Systems


    Banking credentials stolen from development environments often follow predictable patterns:

  • Reused passwords: Developers may reuse credentials across multiple systems
  • Shared infrastructure: Development credentials might also work in staging and production environments
  • Adjacent systems: Banking credentials could provide entry points to related financial platforms

    • ### Institutional Risk: Reputation and Regulatory Damage


    Organizations that unknowingly distributed malicious packages face:

  • Customer trust erosion when breaches are disclosed
  • Regulatory penalties under Brazilian financial regulations and LGPD (Lei Geral de Proteção de Dados)
  • Legal liability if customer fraud results from stolen credentials

    • ## Recommendations for Developers and Organizations


    ### Immediate Actions


    If you installed Sicoob.Sdk versions 2.0.0–2.0.4:


    1. Remove the package immediately from all development environments and build pipelines

    2. Rotate all banking credentials and PFX certificates used with Sicoob APIs

    3. Revoke compromised certificates through Sicoob's credential management portal

    4. Check for exfiltration by reviewing network logs for outbound connections during the installation period

    5. Scan systems for indicators of compromise (persistence mechanisms, additional malware)


    ### Long-Term Defense


    For development teams:

  • Implement dependency scanning tools (e.g., Snyk, Dependabot) to identify suspicious packages before installation
  • Enforce code review requirements for all new dependencies, focusing on obfuscated code
  • Use private package mirrors to vet and cache approved packages, reducing exposure to malicious updates
  • Maintain comprehensive audit logs of package installations across development infrastructure

    • For security teams:

  • Monitor package repositories for typosquatting and impersonation attacks targeting your organization
  • Establish credential policies that prevent banking credentials from being stored in development environments
  • Implement multi-factor authentication on all package manager accounts to prevent unauthorized uploads
  • Conduct supply chain risk assessments targeting financial software vendors and integration partners

    • For organizations using Sicoob APIs:

  • Verify the authenticity of SDKs through official Sicoob channels, not public repositories alone
  • Use pinned dependency versions to prevent automatic updates to compromised releases
  • Isolate development networks that contain banking credentials from general corporate networks
  • Establish anomaly detection on banking API usage to identify suspicious patterns

    • ## HackWire Analysis


    The Sicoob.Sdk attack represents a maturation of supply chain tactics. Unlike earlier incidents that relied on typosquatting or obvious obfuscation, this malware impersonated an entirely legitimate product—a strategy that shifts the burden of detection from automated tools to human judgment and operational discipline.


    What's particularly concerning is the targeting of financial institutions in emerging markets. Sicoob's cooperative structure means the institution serves thousands of smaller banks and credit unions across Brazil, each potentially exposing downstream customers to fraud. A single compromised developer at a partner organization could open pathways to dozens of financial institutions.


    The attack also highlights a blind spot in open-source security: package managers trust repositories more than they trust individual packages. Developers see a package in the official NuGet gallery and assume basic vetting has occurred. In reality, automated systems check for malware signatures they already know—they don't catch sophisticated credential-stealing code buried in obfuscated libraries. The burden of due diligence falls entirely on developers with limited tools to assess code behavior.


    For Brazilian fintech companies and banking partners, this incident demands immediate action. Credentials are not reissuable like passwords—a stolen PFX certificate represents a permanent compromise until manually rotated. Organizations that delay credential rotation risk ongoing unauthorized API access long after discovering the infection. More broadly, any organization integrating with financial systems through public SDK repositories should assume supply chain compromise is an active threat, not a theoretical risk.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Tools](https://www.hackwire.news/category/tools) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)