Sicoob.Sdk versions 2.0.0 through 2.0.4 secretly exfiltrate client IDs, PFX passwords, and base64-encoded certificate archives to a hardcoded Sentry endpoint while posing as an official Sicoob .NET SDK. The malicious NuGet package appears to use a GitHub repository as a clean-source façade and was blocked after disclosure, with indicators tied to Sicoob-Cooperativa, joaobcdev, and the sicoob NuGet profile. #Sicoob.Sdk #Sicoob-Cooperativa #joaobcdev #sicoob
Keypoints
- Sicoob.Sdk 2.0.0 through 2.0.4 exfiltrate banking authentication material during normal client initialization.
- The package reads a user-supplied PFX file, base64-encodes it, and sends it along with the client ID and PFX password to a hardcoded Sentry endpoint.
- The malicious behavior was confirmed through both static and dynamic analysis of the distributed NuGet DLL.
- The linked GitHub repository Sicoob-Cooperativa appears to be an impersonation or clean-source façade and does not match the behavior found in the published package.
- NuGet blocked the package after the abuse report, and related publishing activity was tied to the sicoob profile.
- The same publisher identity released 11 other Sicoob-branded packages that did not show the same exfiltration logic, but remain untrusted by association.
- Potential impact includes impersonation of Sicoob API integrations, credential theft, and exposure of financial API data depending on authorization and server-side controls.
MITRE Techniques
- [T1195.002] Supply Chain Compromise: Compromise Software Dependencies and Development Tools – Malicious code was delivered through a NuGet SDK that appeared legitimate but secretly exfiltrated secrets (‘the linked GitHub repository likely served as a clean or partially clean source façade for a malicious NuGet artifact’).
- [T1204.005] User Execution: Malicious Library – The package executed when developers instantiated SicoobClient in normal application workflows (‘when a developer instantiates SicoobClient… the package reads the PFX file from disk’).
- [T1036.005] Masquerading: Match Legitimate Resource Name or Location – The package and repository used Sicoob branding and claimed to be an official SDK (‘claimed to be an official C# SDK for Sicoob API integrations’).
- [T1552.001] Unsecured Credentials: Credentials in Files – The SDK accessed certificate material stored in a PFX file and exposed its contents (‘reads the PFX file from disk, base64-encodes its contents’).
- [T1005] Data from Local System – It collected local certificate data from the filesystem before transmission (‘File.ReadAllBytes(this.PfxPath)’).
- [T1041] Exfiltration Over C2 Channel – Stolen credentials and certificate contents were sent to a third-party Sentry endpoint (‘sends the supplied client ID, PFX password, and encoded PFX data to a hardcoded third-party Sentry endpoint’).
- [T1071.001] Application Layer Protocol: Web Protocols – The exfiltration used Sentry’s HTTPS-based ingestion service (‘hardcoded third-party Sentry endpoint’).
Indicators of Compromise
- [NuGet package ] malicious package and related versions – Sicoob.Sdk 2.0.0, Sicoob.Sdk 2.0.4
- [NuGet profile ] publishing identity – sicoob
- [GitHub organization ] source façade / impersonation source – Sicoob-Cooperativa, joaobcdev
- [Sentry DSN / endpoint ] exfiltration destination – hxxps://d565e3f03d0b1a7c8935d7ff94237316@o4511335034847232[.]ingest[.]de[.]sentry[.]io/4511337546317904, o4511335034847232[.]ingest[.]de[.]sentry[.]io
- [Sentry project details ] hardcoded telemetry target – 4511337546317904, d565e3f03d0b1a7c8935d7ff94237316
- [Related NuGet packages ] associated package set – Sicoob-Cooperativa.Sicoob.Auth, Sicoob-Cooperativa.Sicoob.Pix
- [Package reference / install command ] likely detection strings – PackageReference Include=”Sicoob.Sdk”, dotnet add package Sicoob.Sdk
Read more: https://socket.dev/blog/malicious-nuget-package-impersonates-sicoob-sdk