Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials

MITRE Techniques

• [T1195 ] Supply Chain Compromise – The attacker published a typosquatted NuGet package to poison developers who install the official SDK (‘malicious NuGet package masquerading as the official Braintree payment gateway client’).
• [T1036 ] Masquerading – The package impersonates the real Braintree library using a similar name, copied metadata, and stolen documentation (‘Package ID: Braintree.Net… Claimed author: Braintree… README bundled in the package is copied from official Braintree documentation’).
• [T1218 ] System Binary Proxy Execution – The malicious DLL executes inside legitimate .NET applications when referenced as a dependency (‘when a .NET application references Braintree.Net and loads the assembly’).
• [T1546 ] Event Triggered Execution – Module initializers run automatically at assembly load without a direct API call (‘[ModuleInitializer] attributes guarantee execution at assembly load’).
• [T1056.001 ] Input Capture: Keylogging – The implant captures sensitive payment fields entered into request objects, including card number and CVV (‘POST cardNumber, cvv, expiration, …’).
• [T1005 ] Data from Local System – The harvester collects environment variables, appsettings files, cloud metadata, mounted secrets, and assembly/dependency data (‘captures Braintree keys from environment variables or appsettings.json, database connection strings, cloud IAM role credentials, and CI/CD tokens’).
• [T1552 ] Unsecured Credentials – The malware exfiltrates merchantId, publicKey, privateKey, and other secrets from configuration and environment (‘steals Braintree merchant API credentials… merchantId, publicKey, and privateKey triple’).
• [T1041 ] Exfiltration Over C2 Channel – Stolen data is sent to attacker-controlled infrastructure via HTTPS POST requests (‘POSTs it to a hardcoded endpoint’).
• [T1027 ] Obfuscated Files or Information – The analytics endpoint is XOR-obfuscated in DependencyInjector.Core to hinder detection (‘the analytics/report endpoint used by DependencyInjector.Core is XOR-obfuscated at rest’).
• [T1562.001 ] Impair Defenses: Disable or Evade Security Tools – Empty catch blocks suppress errors so the victim sees no failures (‘Network failures, TLS errors, and malformed payloads are swallowed silently’).