Malicious NuGet Package Targets Stripe Developers

Reversinglabs

Malicious NuGet Package Targets Stripe Developers

First seen 25 Feb 2026, 20:11 UTC • •26.3

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

Cybersecurity researchers have identified a malicious NuGet package named StripeApi.Net that impersonates Stripe's official .NET library, Stripe.net. This incident represents a shift in threat actors' tactics from targeting cryptocurrency to focusing on the financial sector, affecting developers who integrate Stripe payments into their applications.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 229d ago How this analysis works

Timeline

2026-02-25

Malicious NuGet package targeting Stripe developers uncovered

More articles in this cluster (2)

Threat Graph

6 entities, 9 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Supply Chain Attack
T1041 - Exfiltration Over C2 Channel
T1195 - Supply Chain Compromise

Affected Platform (3)

Stripe
NuGet
Supabase

Relationships

Supply Chain Attack targets Stripe
Supply Chain Attack targets NuGet
Supply Chain Attack targets Supabase
T1041 - Exfiltration Over C2 Channel targets Stripe
T1041 - Exfiltration Over C2 Channel targets NuGet
T1041 - Exfiltration Over C2 Channel targets Supabase
T1195 - Supply Chain Compromise targets Stripe
T1195 - Supply Chain Compromise targets NuGet
T1195 - Supply Chain Compromise targets Supabase

Continue Reading

Microsoft Issues Emergency Patches for Critical Brotli Vulnerability in .NET On October 27, 2026, Microsoft released emergency out-of-band security updates for .NET 8, 9, 10, and 11 RC3 to address CVE-2026-111497, a critical out-of-bounds write vulnerability in the Brotli decompression library. This flaw allows unauthenticated remote attackers to execute arbitrary code by sending crafted…

PHP2Shell Vulnerabilities Exploited by AI-Driven Attackers Threat actors have exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to target a government entity in Europe, gaining access to sensitive data within two hours of the initial breach. The attackers utilized AI tools for reconnaissance and post-exploitation activities, including accessing…