11 mincritical
Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials
A malicious NuGet package named Braintree.Net typosquats the legitimate PayPal Braintree .NET SDK and implements a multi-stage .NET implant that intercepts payment card data, exfiltrates merchant API credentials, and harvests environment secrets upon assembly load. The package uses .NET ModuleInitializer attributes for code execution, production-only gating to avoid detection during QA, and XOR obfuscation for one of its C2 endpoints. Stolen data is POSTed to attacker-controlled infrastructure at api.348672-shakepay.com over HTTPS with silent error handling to avoid triggering investigation.
Sens:■ Immediate
Showing defanged values
- domain348672-shakepay[.]comAttacker-controlled C2 domain impersonating Shakepay brand; used for all exfiltration endpoints (card data, merchant credentials, environment secrets)
- ip104[.]21[.]89[.]51Cloudflare anycast IP resolving for 348672-shakepay.com; shared CDN infrastructure, not attacker-specific — use for correlation context only
- ip172[.]67[.]188[.]32Cloudflare anycast IP resolving for 348672-shakepay.com; shared CDN infrastructure, not attacker-specific — use for correlation context only
- sha256064653872c1b4c3d5b5242627cda259056fed7159fcd2cc5a448981c9f81aedaMalicious Braintree.dll assembly from Braintree.Net package
- sha256220908e8c23c2332266ba1e984f839b9914c2e40a946b172f6d9b8b36728f98aMalicious Braintree.dll assembly from Braintree.Net package
- sha2562547382cd5151e2210c6349f17230ae3d1a59935e3b8d1757d72d9abd30ac858Malicious Braintree.dll assembly from Braintree.Net package
- sha2565138ea25563be4ae8143b7a46c6bc42af00344678e6d4451ac596b5b5587c70eMalicious DependencyInjector.Core.dll assembly variant
- sha25652aeb64f4199235704d0e4a6908c501c3b4bdd4a004a766a5ca55b9655b24775Malicious Braintree.dll assembly from Braintree.Net package
- sha256531302fe3b8a8624aa468ee83707448fbd1db2eaa3f8d587331db2b17890f8adMalicious DependencyInjector.Core.dll assembly variant
- sha2565cae5ec54f450ef7483e265d289edc3877c17e3ae508c06e1679371aa1c1306fMalicious Braintree.dll assembly from Braintree.Net package
- sha2567a9f19ed663c1d4ee259ba0a10e93e1c9770812ce81f8c945140a452d17cb3c8Malicious Braintree.dll assembly from Braintree.Net package containing CardOperationLogger and DependencyInjectorLoader
- sha2567c30f007af910886b46f6022dd724dd303ad2d5f983376d0547293f484d6ae71Malicious DependencyInjector.Core.dll assembly variant containing AnalyticsReporter and EndpointObfuscator
- sha25686d287eafecd542faec21a95522b3425000ae5d8650813a9987b7c10cf90fc7aMalicious Braintree.dll assembly from Braintree.Net package
- sha2569d8d79000f6413668429d851f7d8ce94cd1b61c3a421939cf34cec8d668f5388Malicious DependencyInjector.Core.dll assembly variant
- sha2569dff477e6d30872669bb6186c67147a945d9de7e947eb7906afdb03c93901eadMalicious Braintree.dll assembly from Braintree.Net package
- sha256b4a5bcf4ce8c9cc844c06f436d4c26b28cb408f7e4fd8990681336445493acc1Malicious DependencyInjector.Core.dll assembly variant
- sha256bfdaf869a3956b37bf416dcdafdad314e8de0215cfd8fd8b2bc7a4e5cd15a349Malicious DependencyInjector.Core.dll assembly variant
- sha256c3be125753aea85728a082823db77d833377d7e3eb199364aa49d1ff2535f53eMalicious DependencyInjector.Core.dll assembly variant
- sha256c9564621abec9bdb7ceb38bb1a2895a119772b7f830351272c13a3f4cd606b97Malicious DependencyInjector.Core.dll assembly variant
- sha256d6fbfada62639578b6a6e91786928705dd22bb14b0f030504ffbc974e23528bcMalicious Braintree.dll assembly from Braintree.Net package
- sha256de6384e853dfc007205abb7b15b49eded2e3e977058600dece2c2e9190a5191aMalicious DependencyInjector.Core.dll assembly variant
- sha256e0c7797e7dba2056bc95bfddb96d9f07afb93988f108bc417c40cd05f7ae49a4Malicious Braintree.dll assembly from Braintree.Net package
- sha256eceab1132aacd803962fa173d1b2c43e225fcfa8b5d26d3efadad1b4de33d8ecMalicious DependencyInjector.Core.dll assembly variant
- sha256efec1e537445170a9aac11781c597cba5bd5d25b79ac3d65467d84f109d86fd4Malicious DependencyInjector.Core.dll assembly containing environment harvester with XOR-obfuscated C2 endpoint
- sha256f181d57c29364aef01e3f72051ec2dc0da918d346e7e4d1377e13408afb8663aMalicious Braintree.dll assembly variant from Braintree.Net package
- sha256f53359313ce9a9433651202a7ffbf155dc1379103796a45492a50edbf044d59dMalicious DependencyInjector.Core.dll assembly variant
- urlhxxps://api[.]348672-shakepay[.]com/api/accountEndpoint receiving exfiltrated Braintree merchant credentials (merchantId, publicKey, privateKey) from GatewayInput.AddAccountAsync
- urlhxxps://api[.]348672-shakepay[.]com/api/analytics/reportXOR-obfuscated endpoint receiving environment variables, appsettings.json contents, cloud metadata, and Kubernetes tokens from DependencyInjector.Core harvester
- urlhxxps://api[.]348672-shakepay[.]com/api/cardEndpoint receiving intercepted payment card data (PAN, CVV, expiration, card type, customer ID, amount) from CardOperationLogger hooks
Detection / Hunteropenrouter
What Happened
A fake software package disguised as a legitimate payment processing tool was discovered on the NuGet package repository for .NET developers. When developers accidentally install this fake package (named Braintree.Net instead of the correct Braintree), it secretly captures credit card numbers, security codes, and payment processor login credentials as payments are processed, then sends this stolen data to a server controlled by the attackers. The package also steals cloud service credentials, database connection strings, and other sensitive configuration data from the server it runs on. Any organization that has used this package in production should assume their payment data and merchant credentials have been compromised, rotate all credentials immediately, and replace the package with the legitimate version. Network teams should block traffic to the domain 348672-shakepay.com and search firewall logs for any connections that may have already occurred.
Key Takeaways
- Malicious NuGet package 'Braintree.Net' typosquats the official 'Braintree' SDK and intercepts live payment card data (PAN, CVV, expiration) via hooks on CreditCardGateway and TransactionGateway methods
- The implant exfiltrates Braintree merchant API credentials (merchantId, publicKey, privateKey) when the gateway is configured in production mode, enabling full gateway API access by the attacker
- A companion package 'DependencyInjector.Core' harvests environment variables, appsettings.json contents, cloud metadata, Kubernetes tokens, and connection strings on assembly load via .NET ModuleInitializer attributes
- C2 endpoint for the environment harvester is XOR-obfuscated at rest while payment/card exfiltration endpoints are stored in plaintext, splitting obfuscation strategy across stages
- Sibling packages 'SipNet' and 'SipNet.OpenAI.Realtime' also pull in the malicious DependencyInjector.Core dependency, expanding the blast radius beyond Braintree users
Affected Systems
- .NET applications referencing Braintree.Net (versions 3.35.8–3.36.1)
- .NET applications referencing DependencyInjector.Core (versions 1.0.0, 1.3.0, 1.4.0, 1.4.1)
- .NET applications transitively referencing SipNet (versions 12.8.4–12.8.7) on .NET 8/9/10 targets
- Production payment processing servers using Braintree gateway with Environment.PRODUCTION
- Cloud and container environments (AWS, Azure, GCP, Kubernetes) where the poisoned assemblies are loaded
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Developer installs typosquatted Braintree.Net NuGet package (or transitively via SipNet) mistaking it for the official Braintree SDK
- Execution: .NET ModuleInitializer attributes fire on assembly load, triggering DependencyInjectorLoader.Load() and AutoInitializer.Initialize() without any explicit API call by the victim application
- Collection: CodebaseAnalyzer.AnalyzeAndPrint() harvests environment variables (AWS_, AZURE_, GOOGLE_, KUBERNETES_, etc.), appsettings.json contents, cloud instance metadata, Kubernetes service account tokens, and database connection strings
- Credential Theft: When BraintreeGateway.PrivateKey setter is called in production mode, merchantId/publicKey/privateKey triple is POSTed to attacker C2
- Data Interception: CardOperationLogger hooks intercept CreditCardGateway.Create(), TransactionGateway.Sale(), and similar methods to capture PAN, CVV, expiration, and customer data before the legitimate Braintree API call proceeds
- Exfiltration: All stolen data POSTed as JSON over HTTPS to api.348672-shakepay.com endpoints with X-Api-Key header; all errors silently swallowed via empty catch blocks
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide detection rules but lists code artifacts (class/type names such as Braintree.CardOperationLogger, Braintree.DependencyInjectorLoader, DependencyInjector.Core.Reporting.EndpointObfuscator) and network indicators that could be used to build custom detections.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can observe outbound HTTPS connections from .NET processes to the C2 domain and may detect module initializer execution patterns, but the implant runs within the legitimate application process context and uses standard .NET HTTP client APIs, making process-level behavioral detection challenging without network correlation. |
| Network Visibility | High | All exfiltration occurs over HTTPS to a single attacker-controlled domain with a distinctive X-Api-Key header. Proxy, firewall, and DNS logs can detect connections to api.348672-shakepay.com and the specific API paths (/api/card, /api/account, /api/analytics/report). |
| Detection Difficulty | Moderate | Network-based detection is straightforward due to hardcoded C2 domain and API key header. Host-based detection requires scanning NuGet package dependencies and assembly analysis for malicious class names. The XOR-obfuscated endpoint adds complexity for static analysis but the plaintext card/account endpoints are easily detectable. |
Required Log Sources
- DNS resolution logs
- HTTP proxy logs with SNI/destination URL visibility
- Firewall egress logs
- NuGet package restore logs from CI/CD pipelines
- Assembly load events (ETW .NET runtime)
- File integrity monitoring on NuGet global packages cache
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Hunt for outbound HTTPS connections from .NET application processes to the domain 348672-shakepay.com or its subdomains, which would indicate active exfiltration by the Braintree.Net or DependencyInjector.Core implant. | Proxy logs, firewall egress logs, DNS resolution logs, EDR network connection events | Exfiltration | Low — the domain is attacker-controlled and not associated with legitimate Shakepay infrastructure; any connection is suspicious. |
| Hunt for HTTP requests containing the header X-Api-Key with value matching the known attacker API key pattern, which would confirm communication with the malicious C2 endpoints regardless of domain rotation. | Proxy logs with full header capture, WAF logs, network packet capture | Exfiltration | Low — the specific API key value is hardcoded in the malicious assembly and is not a legitimate credential format. |
| Hunt for .NET assemblies containing types named CardOperationLogger, DependencyInjectorLoader, or AnalyticsReporter in environments where Braintree payment integration is used, which would indicate the typosquatted package was loaded. | ETW .NET assembly load events, EDR module load events, assembly scanning tools | Execution | Low — these class names do not exist in the legitimate Braintree SDK or standard .NET libraries. |
| Hunt for NuGet package restore operations in CI/CD pipelines or developer workstations that reference Braintree.Net, DependencyInjector.Core, or SipNet packages, which would indicate potential supply chain compromise. | CI/CD build logs, NuGet package restore logs, package lock files (packages.lock.json, Directory.Packages.props) | Initial Access | Low — Braintree.Net is not a legitimate package ID; the official package is published as 'Braintree'. |
| Hunt for .NET processes making outbound HTTPS POST requests shortly after assembly load (before any user-initiated payment operation), which could indicate ModuleInitializer-triggered environment exfiltration by DependencyInjector.Core. | EDR process network events with timing correlation, ETW .NET runtime assembly load events | Collection/Exfiltration | Medium — some legitimate .NET applications make startup telemetry or health-check calls; correlate with destination domain and X-Api-Key header to reduce noise. |
Control Gaps
- Traditional AV/signature-based scanning may not detect the malicious assembly since it uses legitimate .NET APIs and compiles to standard IL
- Network DLP solutions may not flag HTTPS exfiltration since payloads are JSON over standard port 443 with no obvious anomalies
- Package download count as a trust signal is unreliable — attacker inflated counts via 120 empty placeholder versions
- Sandbox/QA environments provide no detection signal since card and credential exfiltration is gated to production mode only
- Static analysis of the XOR-obfuscated analytics endpoint would miss the C2 URL without runtime decoding or specific XOR key knowledge
Key Behavioral Indicators
- Outbound HTTPS POST to api.348672-shakepay.com with X-Api-Key header containing 2523-5235-8564-2683-2386
- Presence of Braintree.CardOperationLogger or Braintree.DependencyInjectorLoader types in loaded .NET assemblies
- Presence of DependencyInjector.Core.Reporting.EndpointObfuscator or DependencyInjector.Core.AutoInitializer types in loaded assemblies
- NuGet package references to Braintree.Net (not Braintree), DependencyInjector.Core, or SipNet versions 12.8.4-12.8.7
- HTTP POST requests to /api/card, /api/account, or /api/analytics/report paths on 348672-shakepay.com
- ModuleInitializer-triggered outbound network activity immediately following .NET assembly load with no user-initiated action
False Positive Assessment
Low — the C2 domain 348672-shakepay.com is attacker-controlled and not associated with legitimate Shakepay infrastructure. The X-Api-Key header value and class names (CardOperationLogger, DependencyInjectorLoader) are unique to the malicious assembly and absent from the legitimate Braintree SDK. Cloudflare anycast IPs are shared and should not be used as standalone detection indicators.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Remove Braintree.Net from all projects, central package management files, and CI restore caches; replace with the official Braintree package.
- Consider rotating all Braintree merchant credentials (merchantId, publicKey, privateKey, access tokens) for any environment that ever referenced the malicious package — assume production keys are compromised if the gateway was configured with Environment.PRODUCTION.
- If applicable to your environment, treat card data as potentially disclosed if production traffic ran through the poisoned SDK while card numbers or CVVs were present in request objects; engage PCI incident response and notification processes as required.
- Consider blocking egress to 348672-shakepay.com and all subdomains at network perimeter controls, firewalls, and proxy servers immediately.
- Audit package lock files and dependency graphs for DependencyInjector.Core, SipNet, and SipNet.OpenAI.Realtime in addition to Braintree.Net across all repositories and CI/CD pipelines.
Infrastructure Hardening
- Evaluate implementing NuGet package allowlisting or a private package feed with vetted packages only to prevent typosquatted packages from entering the build pipeline.
- Consider deploying Socket or equivalent software supply-chain scanning tools that analyze package behavior at publish time and detect typosquatting patterns.
- If supported by your tooling, implement network egress allowlisting for production payment processing servers to restrict outbound connections to known Braintree API endpoints only.
- Evaluate enabling DNS response policy zones (RPZ) or similar DNS filtering to block resolution of known malicious domains at the infrastructure level.
User Protection
- Consider implementing developer training on verifying NuGet package authenticity, including checking publisher profiles, download count legitimacy, and package ID precision before installation.
- If your team uses central package management (Directory.Packages.props), evaluate locking all package versions to prevent accidental upgrades to malicious versions.
- Consider deploying runtime application self-protection (RASP) or .NET assembly scanning in CI/CD pipelines to detect unexpected module initializers or outbound network calls in third-party libraries.
Security Awareness
- Consider adding supply-chain attack awareness to existing developer security training programs, emphasizing typosquatting techniques and the importance of verifying package metadata.
- Where applicable, roll into existing awareness programs guidance on checking package publisher profiles (e.g., braintreepayments vs braintree), version scheme consistency, and project URL legitimacy before adding dependencies.
- Consider establishing a process for developers to report suspicious packages to security teams for review before inclusion in projects.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping10 techniques
Tactic
Initial Access
Tactic
Credential Access
Tactic
Discovery
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Ips:
104[.]21[.]89[.]51- Cloudflare anycast IP resolving for 348672-shakepay.com; shared CDN infrastructure, not attacker-specific — use for correlation context only172[.]67[.]188[.]32- Cloudflare anycast IP resolving for 348672-shakepay.com; shared CDN infrastructure, not attacker-specific — use for correlation context only
- File Hashes:
220908e8c23c2332266ba1e984f839b9914c2e40a946b172f6d9b8b36728f98a(SHA256) - Malicious Braintree.dll assembly from Braintree.Net package86d287eafecd542faec21a95522b3425000ae5d8650813a9987b7c10cf90fc7a(SHA256) - Malicious Braintree.dll assembly from Braintree.Net package5cae5ec54f450ef7483e265d289edc3877c17e3ae508c06e1679371aa1c1306f(SHA256) - Malicious Braintree.dll assembly from Braintree.Net packaged6fbfada62639578b6a6e91786928705dd22bb14b0f030504ffbc974e23528bc(SHA256) - Malicious Braintree.dll assembly from Braintree.Net packagee0c7797e7dba2056bc95bfddb96d9f07afb93988f108bc417c40cd05f7ae49a4(SHA256) - Malicious Braintree.dll assembly from Braintree.Net package064653872c1b4c3d5b5242627cda259056fed7159fcd2cc5a448981c9f81aeda(SHA256) - Malicious Braintree.dll assembly from Braintree.Net package2547382cd5151e2210c6349f17230ae3d1a59935e3b8d1757d72d9abd30ac858(SHA256) - Malicious Braintree.dll assembly from Braintree.Net package52aeb64f4199235704d0e4a6908c501c3b4bdd4a004a766a5ca55b9655b24775(SHA256) - Malicious Braintree.dll assembly from Braintree.Net package9dff477e6d30872669bb6186c67147a945d9de7e947eb7906afdb03c93901ead(SHA256) - Malicious Braintree.dll assembly from Braintree.Net package9d8d79000f6413668429d851f7d8ce94cd1b61c3a421939cf34cec8d668f5388(SHA256) - Malicious DependencyInjector.Core.dll assembly variantc9564621abec9bdb7ceb38bb1a2895a119772b7f830351272c13a3f4cd606b97(SHA256) - Malicious DependencyInjector.Core.dll assembly variantf53359313ce9a9433651202a7ffbf155dc1379103796a45492a50edbf044d59d(SHA256) - Malicious DependencyInjector.Core.dll assembly variantb4a5bcf4ce8c9cc844c06f436d4c26b28cb408f7e4fd8990681336445493acc1(SHA256) - Malicious DependencyInjector.Core.dll assembly variant531302fe3b8a8624aa468ee83707448fbd1db2eaa3f8d587331db2b17890f8ad(SHA256) - Malicious DependencyInjector.Core.dll assembly variantbfdaf869a3956b37bf416dcdafdad314e8de0215cfd8fd8b2bc7a4e5cd15a349(SHA256) - Malicious DependencyInjector.Core.dll assembly variant5138ea25563be4ae8143b7a46c6bc42af00344678e6d4451ac596b5b5587c70e(SHA256) - Malicious DependencyInjector.Core.dll assembly varianteceab1132aacd803962fa173d1b2c43e225fcfa8b5d26d3efadad1b4de33d8ec(SHA256) - Malicious DependencyInjector.Core.dll assembly variantde6384e853dfc007205abb7b15b49eded2e3e977058600dece2c2e9190a5191a(SHA256) - Malicious DependencyInjector.Core.dll assembly variantc3be125753aea85728a082823db77d833377d7e3eb199364aa49d1ff2535f53e(SHA256) - Malicious DependencyInjector.Core.dll assembly variant
- Other:
2523-5235-8564-2683-2386- API key sent in X-Api-Key HTTP header for all exfiltration requests to api.348672-shakepay.com endpoints4A7B2C5D1E8F3A6B9C0D5E2F7A4B1C8D- XOR key used by DependencyInjector.Core EndpointObfuscator to decode the analytics/report C2 endpoint at runtime220F582D6DB51544FD7D3701497F24BB7D49012E76EE510EEC6C2701192471A22B0B45727FE15B07E579374C09646EE83A145E29- 52-byte XOR-obfuscated ciphertext blob embedded in DependencyInjector.Core that decodes to the analytics/report C2 URL
