Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets
A malicious NuGet package, 'Sicoob.Sdk,' disguised as a C# SDK for Sicoob, Brazil's largest cooperative financial system, was discovered to be stealing client IDs and PFX certificates. This allowed unauthorized access to Sicoob's banking network, potentially exposing sensitive financial data and enabling impersonation of the victim's API integration. The discovery follows a broader trend of supply chain attacks targeting npm packages, including credential harvesting and malicious proxy services.
The incident involved a NuGet package named 'Sicoob.Sdk' that was downloaded nearly 500 times. This package was designed to exfiltrate sensitive information, including PFX certificates used to authenticate businesses with the Sicoob banking network, allowing for automated banking operations. The package utilized a Sentry endpoint to send client IDs, PFX passwords, and encoded PFX data. Researchers identified additional NuGet packages linked to the same developer, 'sicoob,' totaling 6,000 downloads, further amplifying the risk. The package was initially surfaced by Google Search AI Mode, leading to its unwitting distribution to developers. The compromise of Sicoob API authentication material could expose downstream financial data or enable payment abuse. Affected organizations are advised to immediately remove the package, treat PFX material as compromised, and audit authentication logs.
This incident is part of a larger trend of supply chain attacks targeting the npm ecosystem. Specifically, the Microsoft Defender Security Research Team identified 14 malicious npm packages, published by the threat actor 'vpmdhaj,' designed to harvest AWS credentials, HashiCorp Vault tokens, and CI/CD pipeline secrets. These packages leveraged typosquatting of popular libraries like OpenSearch and ElasticSearch. Furthermore, the research team highlighted a separate campaign involving 164 malicious npm packages containing postinstall payloads that download and execute JavaScript to send environment variables to a command-and-control server. These findings underscore the vulnerability of relying on third-party packages and the importance of rigorous security practices within the software development lifecycle.