Fake Banking SDK Exposes Developer Secrets Arabian Post

(MENAFN- The Arabian Post) clearfix"> A malicious NuGet package posing as a Sicoob software development kit has exposed sensitive banking authentication data, intensifying concerns over attacks that exploit trust in open-source developer ecosystems.

The package, published as Sicoob. Sdk, was presented as a C# SDK for integrations with Sicoob, one of Brazil's largest cooperative financial systems. Versions 2.0.0 to 2.0.4 were found to collect client IDs, PFX passwords and base64-encoded PFX certificate archives when developers used the package to configure banking API connections. The package first appeared on NuGet on 5 May 2026, reached version 2.0.4 a day later and was blocked after abuse reporting.

The discovery points to a more targeted form of software supply-chain attack, with malicious actors no longer relying solely on broad typosquatting or commodity credential theft. By impersonating a financial-services SDK, the package placed itself inside workflows where developers would naturally provide authentication material for real banking integrations, including certificates used in mutual TLS authentication.

The stolen data could allow an attacker to impersonate affected applications or organisations if the certificates and client IDs remained valid and had sufficient permissions. Such access could create risks around payment automation, Pix transactions, boleto processing, Open Finance operations, account-data retrieval and other financial API activity. The level of exposure would depend on Sicoob-side controls, API scopes, certificate authorisation and whether affected organisations rotated credentials after installation.

The malicious code operated during normal client initialisation. When a developer supplied a client ID, a PFX file path and a PFX password, the package read the certificate archive from disk, converted it into base64 form and transmitted it with the accompanying credentials to a hardcoded third-party Sentry endpoint. A separate capture path was also identified for raw boleto API responses, which may contain transaction details, payment status, amounts, due dates and payer or payee identifiers.

See also BTMOB puts Android users at takeover risk

The case is notable because the public-facing code repository linked to the package appeared to act as a clean façade. The visible source showed ordinary SDK behaviour, such as loading certificates and configuring API clients, while the malicious exfiltration logic was present in the compiled NuGet artefact. This source-to-package mismatch is particularly difficult for developers to detect when they rely on repository links, package descriptions and routine installation commands rather than inspecting compiled binaries.

Investigators also found signs of impersonation around the GitHub organisation associated with the package. The organisation was newly created, unverified and lacked public indicators normally associated with an official banking institution's developer tooling. The repositories claimed official SDK status, but there was no reliable external confirmation that the publisher was authorised by Sicoob.

The NuGet publisher profile behind the package listed 12 Sicoob-branded packages. The confirmed malicious wrapper package depended on several related modules, leaving the broader package set untrusted by association even where identical exfiltration behaviour was not independently identified in every component. The package itself was estimated to have drawn nearly 500 downloads, while the wider set accumulated several thousand.

Sicoob's position in Brazil's financial system increased the sensitivity of the incident. The cooperative system serves millions of members and maintains a broad network of cooperative service points, digital channels and payment services. Its 2024 sustainability disclosures show a physical presence across 2,427 municipalities, with Sicoob acting as the only financial institution in 414 of them. That reach makes developer-facing tools linked to its ecosystem attractive targets for attackers seeking access to payment and account-service infrastructure.

See also n8n flaws widen automation security risk

The attack lands during a wider escalation in malicious package activity across open-source registries. Separate npm campaigns have targeted OpenSearch, ElasticSearch, DevOps and environment-configuration users with packages designed to harvest AWS credentials, HashiCorp Vault tokens, npm tokens and CI/CD pipeline secrets. One campaign involved 14 packages published within a four-hour window under a newly created maintainer identity.

Security teams are being pushed to treat package installation as a high-risk stage of the software lifecycle rather than a routine engineering step. Attackers increasingly use convincing names, realistic repository links, plausible documentation and clean-looking source code to create a sense of legitimacy. The danger is greater when the package is expected to handle secrets by design, as with SDKs for banking, cloud, identity, payments and deployment infrastructure.

Organisations that installed Sicoob. Sdk need to remove the package, treat affected PFX material as compromised, replace exposed certificates, rotate PFX passwords, and disable or rotate client IDs where possible. They also need to review authentication and API logs for unusual token issuance, unfamiliar source IP addresses, unexplained Pix or boleto activity, payment requests, transfer attempts, Open Finance calls and account-data queries.

Also published on Medium.

MENAFN30052026000152002308ID1111187171