Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets
Summary: Researchers at Socket found that versions 2.0.0 through 2.0.4 of a NuGet package called "Sicoob.Sdk" read PFX certificate files from disk, Base64-encode them, and send the contents along with the supplied client ID and PFX password to a hardcoded third-party Sentry endpoint, and the package is estimated to have been downloaded nearly 500 times before NuGet blocked it. The profile behind it, named "sicoob," listed 11 other NuGet packages with about 6,000 combined downloads, and Google Search AI Mode surfaced the malicious package as a legitimate C# library for Sicoob banking APIs.
Why it matters: The stolen PFX certificates and client IDs authenticate businesses to Sicoob's banking network for instant payments and dynamic Pix QR codes, so the actor can impersonate a victim's banking API integration and reach downstream financial data and payment abuse. Separately, 14 malicious npm packages published by a single actor on May 28, 2026 use a preinstall hook to harvest AWS credentials, HashiCorp Vault tokens, npm tokens, and CI/CD pipeline secrets.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026