Fake Sicoob SDK on NuGet Quietly Drains Banking Credentials While npm Packages Hunt Cloud Secrets
Supply chain attackers are impersonating legitimate financial SDKs to steal PFX certificates and client IDs — and the developer ecosystem is the perfect delivery mechanism.
Written by OutOfToken AI
June 8, 2026 · 4 min read · Synthesized from reporting by The Hacker News · How this works
Attackers have embedded credential-stealing malware inside a counterfeit C# SDK on NuGet, targeting integrators of Sicoob — one of Brazil's largest cooperative banking networks — in a supply chain strike that exploits developer trust at the package level. Security firm Socket uncovered the campaign, identifying versions 2.0.0 through 2.0.4 of a package called 'Sicoob.Sdk' as the infection vector. The package doesn't just steal passwords — it exfiltrates PFX certificates, handing attackers the cryptographic keys to impersonate entire banking API integrations.
The Anatomy of a Financial SDK Trojan
PFX certificates are not trivial data. In banking API ecosystems like Sicoob's, they authenticate and encrypt communication between a financial institution and its integrating software clients. Stealing one effectively gives a threat actor a signed identity — the ability to appear as a legitimate business conducting authenticated transactions against Sicoob's infrastructure. The malicious package was crafted to mimic the naming convention and surface-level functionality of a genuine SDK, making it visually indistinguishable from the real thing in a dependency manifest. Client IDs harvested alongside the certificates complete the credential pair needed for full API impersonation, a combination that could enable unauthorized fund transfers, fraudulent API calls, or persistent access to business banking operations.
NuGet and npm: Two Ecosystems, One Threat Wave
The Sicoob attack doesn't exist in isolation. Socket's research sits alongside a parallel wave of malicious npm packages engineered to harvest cloud secrets — targeting environment variables, AWS credentials, and API tokens baked into developer workflows. Together, the two campaigns illustrate a broadening front in supply chain exploitation: attackers are no longer just going after end-users but systematically targeting the developers who build the systems those users depend on. NuGet, Microsoft's package repository for .NET and C# developers, has historically received less adversarial scrutiny than npm, making it a relatively softer target for impersonation attacks where brand recognition and naming plausibility carry significant weight.
"Stealing a PFX certificate doesn't just compromise a credential — it compromises an identity. An attacker with a valid certificate and client ID can transact as the victim inside Brazil's cooperative banking infrastructure indefinitely."
Why Developers Remain the Weakest Link in Financial Security
The attack pattern exploits a structural vulnerability in how modern software is assembled. Developers routinely pull third-party packages into production systems with minimal vetting, relying on repository reputation and download counts as proxies for safety. A package that mimics the name of a known banking SDK passes this informal scrutiny almost automatically. In regulated financial environments — where integrators are processing real transactions against live banking APIs — the downstream consequences of a compromised developer machine are catastrophic and immediate. The Sicoob campaign is particularly pointed: Brazil's cooperative financial sector is a high-value target, and its developer integrators represent an attack surface that traditional perimeter security models don't adequately address. Socket's detection methodology, which analyzes package behavior rather than relying purely on signature matching, caught what conventional tooling would likely have missed.
As financial institutions deepen their API ecosystems and pull more third-party developers into their infrastructure, the SDK-as-malware vector will only grow more attractive to threat actors. Organizations integrating with banking APIs must move beyond implicit trust in public repositories — mandatory code review of dependencies, software composition analysis tools with behavioral detection, and certificate lifecycle monitoring are no longer optional hygiene. The Sicoob incident is a precise strike at the intersection of developer convenience and financial security, and it signals that supply chain attackers have found their next lucrative frontier.
Editorial Note
The Hacker News is a reputable cybersecurity news outlet with established credibility for reporting on supply chain attacks and malicious packages. Socket is a known security firm that specializes in dependency vulnerability detection. The attack pattern (malicious SDK packages targeting financial systems) aligns with documented trends in 2023-2024 supply chain security incidents.
Claim Tracker
AI-assessed
Socket is a legitimate package security firm; this discovery aligns with their public security research practices
Sicoob is a well-documented Brazilian credit union confederation
Specific technical details about exfiltration methods are attributed to Socket but direct technical analysis not provided in excerpt
Standard cryptographic practice; technically accurate description of PKI certificates in banking
Plausible supply chain attack vector but specific evidence of deception tactics not detailed in excerpt
Ask AI about this story
// discussion
sign in to join the discussion