Sicoob.Sdk NuGet package trojanized v2.0.0 to 2.0.4 exfiltrated PFX banking certificates and Pix credentials, Socket researchers report
Brazilian businesses that pulled a fake Sicoob banking SDK from NuGet in the last 3 weeks may have leaked the certificates that authorize their Pix payments. Socket found Sicoob.Sdk v2.0.0-2.0.4 (about 500 downloads) shipped PFX files and passwords to an attacker endpoint.
Brazilian businesses that integrated a fake Sicoob banking SDK from NuGet in the last three weeks may have leaked the cryptographic certificates that authorize their Pix payments. Socket researchers report that a malicious package named Sicoob.Sdk, published on May 5 and downloaded close to 500 times before takedown, impersonated a development kit for one of Brazil's largest cooperative financial systems. Versions 2.0.0 through 2.0.4 contained credential-exfiltration code: when a developer instantiated the SicoobClient with a client ID, a PFX file path and a PFX password, the package read the PFX file from disk, base64-encoded it, and transmitted the data along with the credentials to a hardcoded third-party Sentry endpoint. PFX certificates are the authentication material that Brazilian businesses use to automate Pix payments and dynamic QR-code generation through the Sicoob banking network. An attacker holding stolen PFX material plus the matching password can impersonate the legitimate business on Sicoob's APIs. Exposure was amplified when Google $GOOGL AI-driven search results briefly surfaced Sicoob.Sdk as the recommended .NET integration path for Sicoob's banking APIs, directing developers to the trojanized package. NuGet has since blocked the listing. Socket recommends that organizations who installed the package remove it immediately, treat all PFX material as compromised, replace exposed certificates, rotate PFX passwords and disable affected client IDs. Source: Socket via The Hacker News (May 29, 2026).