NuGet ‘Sicoob.Sdk’ package stole PFX certificates, client IDs

Security researchers identified a malicious NuGet package published as a C# SDK for Sicoob that collected client IDs, PFX certificates and PFX passwords. The package, published in versions 2.0.0 through 2.0.4 and downloaded nearly 500 times, was removed from NuGet after disclosure.

Analysis by application security researchers found that when a developer created an SicoobClient with a client ID, a path to a PFX file and a PFX password, the library read the PFX file from disk, Base64-encoded its contents and transmitted the encoded certificate, the client ID and the PFX password to a hardcoded third-party Sentry endpoint. The package also used a separate Sentry path to capture raw responses from Sicoob’s Boleto API, collecting payment status, amounts, due dates and payer or payee identifiers.

PFX certificates are used by businesses to authenticate to Sicoob’s banking network and to automate operations such as instant payments and generation of dynamic Pix QR codes. If an attacker obtains PFX files and related credentials, they could impersonate a victim’s integration with Sicoob and attempt unauthorized transactions or access downstream financial data.

Researchers recommended that any organization that installed Sicoob.Sdk v2.0.0–2.0.4 remove the package immediately, treat exposed PFX material as compromised, replace affected certificates, rotate PFX passwords and change or disable impacted client IDs. Organizations were also advised to audit Sicoob authentication records and API logs for signs of unusual activity.

The published artifact differed from the linked GitHub repository: the repository appeared clean while the package in the registry contained the data-stealing functionality, indicating a source-to-package mismatch. The NuGet profile that uploaded the package, using the name “sicoob,” had published 11 other packages that together had about 6,000 downloads. Researchers also reported that the package was surfaced by Google Search AI Mode as a legitimate C# library, increasing the chance that developers searching for Sicoob tooling would find and install it.

The incident forms part of a wider pattern of supply chain attacks on developer registries. Security teams have observed campaigns on package registries that use typosquatting, dependency confusion and scripted install hooks to harvest cloud credentials, CI/CD secrets and environment variables or to deploy secondary payloads. These campaigns have used high version numbers, altered package names that appear legitimate in developer workflows, and postinstall or preinstall hooks to run data-collection code on compromised hosts.

Security teams and developers who manage Sicoob integrations should check dependency manifests and build logs for any installation of Sicoob.Sdk v2.0.0–2.0.4, remove the package if present, and follow forensic and remediation steps for potentially exposed authentication material. Replacing exposed PFX certificates, rotating passwords and reviewing API and banking logs remain the primary actions to limit potential fraud and impersonation.