Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets

A malicious NuGet package masquerades as a C# SDK for Sicoob, a major Brazilian cooperative financial system. Versions 2.0.0 through 2.0.4 contain functionality that exfiltrates sensitive information, including PFX certificates used to authenticate businesses with the Sicoob banking network. When a developer creates a SicoobClient using a client ID, PFX file path, and PFX password, the package reads the PFX from disk, Base64-encodes it, and sends the client ID, password, and encoded certificate to a hardcoded third-party endpoint. The package also captures raw Boleto API responses, potentially exposing transaction details, payment status, amounts, due dates, identifiers, and payer or payee data. The package was blocked by NuGet after responsible disclosure and was promoted to developers via search results.

"Versions 2.0.0 through 2.0.4 of "Sicoob.Sdk" contain functionality to exfiltrate sensitive information, including PFX certificates that are used to authenticate businesses with the Sicoob banking network in order to automate banking operations, such as processing instant payments and generating dynamic Pix QR codes."

"When a developer instantiates SicoobClient with a client ID, a PFX file path, and a PFX password, the package reads the PFX file from disk, Base64-encodes its contents, and sends the supplied client ID, PFX password, and encoded PFX data to a hardcoded third-party Sentry endpoint."

"In addition, the package is designed to capture raw Boleto API responses via a separate Sentry path. Boleto is a popular cash payment method in Brazil for making online and offline purchases. This can potentially expose sensitive transaction details, payment status, amounts, due dates, identifiers, and payer or payee data."

"As a result, the stolen data could open the door to severe risks, as it can be abused by the threat actor to impersonate the victim's Sicoob banking API integration, Socket added. Following responsible disclosure, the package has been blocked by NuGet. The profile behind the package, named "sicoob," has also listed 11 other NuGet packages that have collectively racked up about 6,000 downloads."

Read at The Hacker News