Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Sicoob.Sdk masquerades as a C# SDK for Brazil's Sicoob cooperative and silently exfiltrates client IDs and PFX certificates.
- Sicoob.Sdk versions 2.0.0 through 2.0.4 were published on NuGet before the theft was discovered, according to security firm Socket.
- npm packages are reported to be targeting cloud secrets, expanding the credential‑theft threat beyond .NET ecosystems.
Why it matters: Sicoob’s customers lose the confidentiality of their banking IDs and certificates, while attackers gain the data needed to impersonate accounts and commit fraud, jeopardizing the cooperative’s trust and financial security.
Ask SkimNews
