THREAT INTELLIGENCE REPORT

Malicious Sicoob NuGet Package and npm Supply Chain Campaign Targeting Banking Credentials and Cloud Secrets

Analysis of a software supply chain attack involving a malicious NuGet package impersonating the Sicoob banking SDK and multiple npm packages designed to steal cloud credentials, CI/CD secrets, tokens, and developer environment data.

Threat Type
Supply Chain Attack
Target
Developers & Organizations
Platforms
NuGet & npm
Report Date
May 2026

Executive Summary

Researchers identified a malicious NuGet package named Sicoob.Sdk that impersonated a legitimate SDK used to interact with Sicoob banking APIs in Brazil. The package secretly exfiltrated client IDs, PFX certificates, certificate passwords, and banking API data to attacker-controlled infrastructure.

At the same time, multiple malicious npm packages were discovered harvesting AWS credentials, HashiCorp Vault tokens, npm tokens, CI/CD secrets, environment variables, and developer workstation information through preinstall and postinstall scripts.

Critical Finding: Compromised certificates and cloud credentials may allow attackers to impersonate banking integrations, access sensitive infrastructure, abuse payment systems, and compromise software delivery pipelines.

Campaign Metrics

Threat Level

Critical

NuGet Downloads

~500

Additional Packages

11+

Malicious npm Packages

179+

Target Secrets

Cloud & Banking

Attack Vector

Supply Chain

Threat Overview

Category Details
Primary Package Sicoob.Sdk
Package Versions 2.0.0 – 2.0.4
Target Sector Financial Services
Credential Types PFX Certificates, Client IDs, Tokens
Cloud Secrets AWS, npm, Vault, CI/CD
Attack Method Package Repository Abuse

Attack Timeline

Package Publication

Threat actors publish malicious packages to NuGet and npm repositories.

Developer Installation

Developers install packages believing them to be legitimate SDKs and utilities.

Credential Collection

Certificates, API credentials, environment variables, and tokens are harvested.

Data Exfiltration

Collected secrets are transmitted to attacker-controlled infrastructure.

Potential Follow-On Abuse

Stolen credentials may be leveraged for fraud, infrastructure compromise, or further supply chain attacks.

Technical Analysis

Malicious NuGet Package

The package captured client IDs, PFX passwords, and certificate files used for banking authentication. The information was encoded and transmitted to external endpoints.

npm Credential Harvester

Malicious npm packages executed automatically during installation through preinstall and postinstall hooks, collecting sensitive credentials and CI/CD secrets from development environments.

Detection Challenge: The packages appeared legitimate and closely resembled common developer utilities, increasing the likelihood of accidental installation.

Targeted Assets

Asset Type Risk
PFX Certificates Authentication Abuse
AWS Credentials Cloud Compromise
Vault Tokens Secret Disclosure
npm Tokens Package Hijacking
CI/CD Secrets Pipeline Compromise
Banking API Credentials Financial Fraud

Indicators of Compromise (IOCs)

Type Indicator
NuGet Package Sicoob.Sdk
Package Versions 2.0.0 - 2.0.4
Threat Actor vpmdhaj
Email a39155771@gmail.com
C2 Host oob.moika[.]tech
Header Value l95HdDaz3kQx1Zsg3WxH6HvKANf51RY1
Immediate Action Required: Remove affected packages, rotate all exposed credentials, replace certificates, revoke compromised tokens, and review authentication logs for unauthorized activity.

MITRE ATT&CK Mapping

Tactic Technique ID
Initial Access Supply Chain Compromise T1195
Credential Access Credentials from Password Stores T1555
Collection Data from Local System T1005
Execution Command and Scripting Interpreter T1059
Exfiltration Exfiltration Over Web Services T1567

Mitigation Recommendations

  1. Remove malicious packages immediately.
  2. Rotate AWS, Vault, npm, and CI/CD credentials.
  3. Replace exposed PFX certificates.
  4. Audit package dependencies regularly.
  5. Implement software composition analysis (SCA).
  6. Verify package publishers before installation.
  7. Monitor package installation hooks.
  8. Use private registries where possible.
Best Practice: Implement dependency scanning, package reputation validation, code signing verification, and least-privilege access controls across development environments.

References