Malicious NuGet Package Targets Sicoob SDK, Exfiltrates Banking Credentials

Thehackernews

Malicious NuGet Package Targets Sicoob SDK, Exfiltrates Banking Credentials

First seen 29 May 2026, 15:45 UTC • •69.0

Article Content

1 / 4

Browse articles

ThreatCluster •May 30, 2026 at 15:20 UTC

•A malicious NuGet package masquerading as Sicoob SDK has been discovered.
•The package exfiltrates sensitive banking credentials, including client IDs and PFX certificates.
•Versions 2.0.0 to 2.0.4 of 'Sicoob.Sdk' are confirmed to be compromised.

A malicious NuGet package named 'Sicoob.Sdk' has been identified, which impersonates an official software development kit for Sicoob, a major Brazilian cooperative financial system. This package, affecting versions 2.0.0 to 2.0.4, is designed to exfiltrate sensitive banking credentials, including client IDs and PFX certificates. The attack specifically targets developers integrating with Sicoob's banking APIs, raising significant concerns about software supply chain security in the financial sector. Cybersecurity researchers from Socket confirmed the malicious functionality of the package, which has the potential to compromise numerous banking accounts. The discovery was made public on May 29, 2026, prompting immediate warnings for developers to avoid using the compromised package. The full scope of the impact remains unclear, but the incident highlights vulnerabilities in software supply chains.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 145d ago How this analysis works

Timeline

2026-05-29

Malicious NuGet package identified

Cybersecurity researchers found a NuGet package impersonating Sicoob SDK that exfiltrates banking credentials.

The Hacker News

2026-05-29

Warnings issued to developers

Developers were advised to avoid using the compromised 'Sicoob.Sdk' package to protect sensitive information.

Cybersecuritynews

More articles in this cluster (3)

Threat Graph

7 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Malware
Supply Chain Attack
T1041 - Exfiltration Over C2 Channel
T1195 - Supply Chain Compromise

Organization (1)

Sicoob

Affected Platform (1)

NuGet

Tool (1)

Npm

Relationships

Malware targets NuGet
Supply Chain Attack targets NuGet
T1041 - Exfiltration Over C2 Channel targets NuGet
T1195 - Supply Chain Compromise targets NuGet
Npm related to Sicoob

Following this threat?

Track Sicoob in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Critical SQL Injection Zero-Day in Arista VeloCloud Orchestrator Exploited Arista Networks has patched a critical zero-day vulnerability (CVE-2026-114625) in its VeloCloud Orchestrator (VCO) that is actively being exploited. The flaw allows authenticated users, even those with basic privileges, to escalate their access to superuser status via a low-complexity SQL injection attack. This…