Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials

Attackers published a malicious NuGet package named 'Braintree.Net' designed to impersonate PayPal's official Braintree SDK, intercepting live payment card data (PAN, CVV, expiration dates) and harvesting merchant API credentials at runtime. The attackers artificially inflated download counts to ~14 million by publishing 120 empty placeholder versions, creating a false sense of legitimacy and making the package appear widely trusted. This attack exploits the inherent trust developers place in package repositories and the lack of rigorous verification before integrating third-party dependencies into payment-critical applications. The impact is severe: any merchant application that installed the malicious versions was effectively a live skimmer, exfiltrating sensitive cardholder data directly to attacker-controlled infrastructure, triggering potential PCI DSS breach obligations.