Malicious Sicoob NuGet SDK Exfiltrated Banking Credentials and Certificates

May 28, 2026 · Original article ↗

Summary

Socket analyzed Sicoob.Sdk versions 2.0.0–2.0.4, which sent client IDs, PFX passwords, and encoded certificates to a hardcoded Sentry endpoint. NuGet blocked the package after a report.

Key points

Versions 2.0.0–2.0.4 exfiltrated client IDs, plaintext PFX passwords, and base64-encoded certificate archives when SicoobClient was instantiated outside sandbox mode.
Static analysis also identified a separate path that sent raw boleto API responses to Sentry; the certificate and credential exfiltration was confirmed through static and dynamic analysis.
The published NuGet DLL contained Sentry-based exfiltration code absent from the visible GitHub source, which the researchers assess likely served as a clean or partially clean façade.
The package impersonated an official Sicoob SDK; the researchers found high-confidence signs that its GitHub organization and NuGet publisher were unauthorized.
NuGet blocked Sicoob.Sdk after Socket's abuse report. The 11 related packages did not show the same standalone exfiltration logic but remain untrusted by association.
Organizations that used affected versions with real credentials should remove the package, treat the credentials and certificates as compromised, rotate or revoke them, and review Sicoob activity and network logs.

Article Details

Attack Vectors: Sicoob.Sdk versions 2.0.0 through 2.0.4 were distributed on NuGet as an allegedly official C# banking SDK. The publisher used Sicoob branding and linked to a GitHub organization assessed by the researchers as a high-confidence unauthorized impersonation.
Instantiating SicoobClient with real credentials in production mode initializes a hardcoded telemetry destination, reads the supplied PFX archive, and transmits its base64-encoded contents together with the client ID and plaintext PFX password. Static and dynamic analysis confirmed this behavior.
Static analysis identified a separate capture path that sends raw boleto API responses through telemetry; this path was not reported as dynamically confirmed.
The distributed DLL contains exfiltration logic absent from the visible GitHub source. Researchers assessed the repository as a likely clean or partially clean source façade.
Applications, developer workstations, and CI or deployment jobs can expose credentials when they instantiate the malicious SDK with real authentication material.
Defensive Notes: Remove affected SDK versions and investigate whether applications, workstations, build jobs, or production services instantiated the client with real credentials.
Treat real PFX material supplied to affected versions as compromised. Revoke and replace exposed certificates, rotate PFX passwords, and rotate or disable affected client IDs where possible.
Review authentication and API logs for unusual token issuance, source IPs, payment activity, boleto access, transfers, Open Finance operations, and account-data retrieval.
Search DNS, proxy, firewall, and EDR telemetry for connections to the reported exfiltration endpoint.
Check repositories, build definitions, deployment scripts, and configuration stores for affected package references, client construction, and associated credential settings.
Replace the SDK only with code or packages verified through institution-controlled channels. The other 11 packages from the same publisher lacked the same independently identified exfiltration logic but remained untrusted by association.
Apply additional dependency review before production use to SDKs that handle certificates, private keys, tokens, signing keys, or other secrets.
NuGet blocked the malicious package following the researchers' abuse report.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`o4511335034847232[.]ingest[.]de[.]sentry[.]io`	Sentry ingestion host explicitly identified as the network destination for the package's credential and certificate exfiltration.
URL	`hxxps[:]//github[.]com/joaobcdev`	Associated GitHub contributor account listed as a threat-research indicator for the suspicious publishing infrastructure; its relationship to the organization was described as apparent.
URL	`hxxps[:]//github[.]com/Sicoob-Cooperativa`	GitHub organization assessed as a high-confidence unauthorized Sicoob impersonation, hosting the apparent clean-source façade linked to the malicious package.
URL	`hxxps[:]//o4511335034847232[.]ingest[.]de[.]sentry[.]io/4511337546317904`	Hardcoded Sentry DSN used by the malicious SDK to exfiltrate client IDs, plaintext PFX passwords, and base64-encoded PFX archives.
URL	`hxxps[:]//www[.]nuget[.]org/profiles/sicoob`	NuGet publishing profile identified by the researchers as malicious; it distributed Sicoob.Sdk and 11 associated packages.