Socket: Malicious NuGet Package Impersonates Sicoob Banking SDK

What it is

Sicoob.Sdk, a malicious NuGet package impersonating an official .NET 8 C# SDK for Sicoob (a major Brazilian cooperative bank). Versions 2.0.0 through 2.0.4 exfiltrate banking authentication material. First appeared on NuGet May 5, 2026; reached 2.0.4 on May 6, 2026; blocked by NuGet after Socket's abuse report. Published by NuGet owner sicoob, which listed 12 Sicoob-branded packages total.

How it works

The malicious logic lives only in the compiled DLL — lib/net8.0/Sicoob.Sdk.dll — and is absent from the linked GitHub source. When SicoobClient is instantiated with a client ID, PFX file path, and PFX password (the normal usage the package documents for mTLS banking auth), the constructor:

• initializes Sentry with a hardcoded DSN,
• reads the PFX file from disk,
• base64-encodes its contents,
• sends a Sentry message containing the client ID, PFX password, and encoded PFX archive.

A PFX archive typically holds the client certificate and private key for mutual TLS, so the stolen data could let an attacker impersonate the victim's Sicoob API integration (subject to certificate scope and Sicoob-side controls). Both static and dynamic analysis confirmed the behavior.

One detail beyond the summary: exfiltration fires only when SicoobClient is constructed outside sandbox mode — there is a sandbox-mode branch that suppresses it.

Preconditions / Affected

• You installed Sicoob.Sdk at version 2.0.0–2.0.4 and instantiate SicoobClient outside sandbox mode with real credentials.
• Also treat the other 11 packages from the sicoob owner as untrusted by association — they lacked the exfiltration logic themselves but were pulled in as dependencies of the malicious wrapper and share the malicious publishing identity.

What to do

• Remove Sicoob.Sdk and any transitive sicoob-owner packages from your dependency graph.
• Rotate any Sicoob client IDs, PFX passwords, and mTLS certificates that were ever loaded through this SDK on a non-sandbox path — treat them as compromised, not merely exposed.
• Do not trust the GitHub org Sicoob-Cooperativa or contributor joaobcdev as an official source; the org is newly created, unverified, has no public members, and the contributor account was created within minutes of it.
• Hunt for outbound traffic to a hardcoded Sentry DSN from build/CI or app hosts running the SDK.

Caveats

• Actual impersonation impact "depends on certificate authorization, API scopes, and Sicoob-side controls" — Socket does not confirm exploited accounts, only the capability.
• The 11 sibling packages are flagged by association, not by independently confirmed malicious code.
• The full hardcoded Sentry DSN and IL excerpt were on the page but truncated in the fetched text; retrieve them from the original for detection signatures.