--- title: Fake Braintree NuGet Package Skims Credit Cards and... description: A malicious NuGet package named Braintree.Net was discovered typosquatting the official Braintree .NET SDK. It implements a multi-stage implant that intercepts... canonical: https://daily.dev/posts/fake-braintree-nuget-package-skims-credit-cards-and-harvests--ou2h4ztn8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Fake Braintree NuGet Package Skims Credit Cards and Harvests... | daily.dev og:description: A malicious NuGet package named Braintree.Net was discovered typosquatting the official Braintree .NET SDK. It implements a multi-stage implant that intercepts... og:url: https://daily.dev/posts/fake-braintree-nuget-package-skims-credit-cards-and-harvests--ou2h4ztn8 og:image: https://api.daily.dev/og/posts/ou2H4ztn8.png og:image:alt: Fake Braintree NuGet Package Skims Credit Cards and Harvests... og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Fake Braintree NuGet Package Skims Credit Cards and Harvests... **[Socket](https://daily.dev/sources/socketdev)** · 11 min read · 0 upvotes · 0 comments ## Summary A malicious NuGet package named Braintree.Net was discovered typosquatting the official Braintree .NET SDK. It implements a multi-stage implant that intercepts live payment card data (PAN/CVV), exfiltrates Braintree merchant API keys (merchantId, publicKey, privateKey), and harvests host environment secrets including cloud IAM credentials, database connection strings, and Kubernetes tokens. The package mimics the legitimate SDK's public API so applications function normally while silently exfiltrating data. A companion package, DependencyInjector.Core, provides a broader environment harvester with XOR-obfuscated C2 endpoints. The attacker inflated download counts with 120 empty placeholder versions. Affected developers should immediately remove the package, rotate all Braintree credentials, treat card data as compromised, and audit for companion packages. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Malicious NuGet Package Impersonates Sicoob SDK to Exfiltrat...](https://daily.dev/posts/malicious-nuget-package-impersonates-sicoob-sdk-to-exfiltrat--7hgwambv3) · Socket · 0 upvotes · 0 comments - [Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials](https://daily.dev/posts/fake-paysafe-skrill-sdks-on-npm-and-pypi-steal-credentials-vvg2hrekd) · BleepingComputer · 0 upvotes · 0 comments - [Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer](https://daily.dev/posts/mini-shai-hulud-targets-sap-npm-packages-with-a-bun-based-secret-stealer-klxyhwkh8) · Aikido Security · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#.net](https://daily.dev/tags/.net), [#malware](https://daily.dev/tags/malware), [#nuget](https://daily.dev/tags/nuget) [View this post on daily.dev](https://daily.dev/posts/fake-braintree-nuget-package-skims-credit-cards-and-harvests--ou2h4ztn8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Fake Braintree NuGet Package Skims Credit Cards and Harvests...","url":"https://daily.dev/posts/fake-braintree-nuget-package-skims-credit-cards-and-harvests--ou2h4ztn8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fake-braintree-nuget-package-skims-credit-cards-and-harvests--ou2h4ztn8"},"datePublished":"2026-07-09T21:00:22.227Z","dateModified":"2026-07-09T21:00:49.577Z","description":"A malicious NuGet package named Braintree.Net was discovered typosquatting the official Braintree .NET SDK. It implements a multi-stage implant that intercepts...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/59cea4dc1185ab3f543a86a1a3ec37be?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/59cea4dc1185ab3f543a86a1a3ec37be?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fake-braintree-nuget-package-skims-credit-cards-and-harvests--ou2h4ztn8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,.net,malware,nuget","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"Fake Braintree NuGet Package Skims Credit Cards and Harvests..."}]} ```