[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvQhhRlGuA0q1554FtBkwh2O0KB4z8AAXuMOxMU7pOI8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":56},"b0c1ca4b-9794-4346-a063-3d656fb8ba50","fake-braintree-nuget-package-steals-payment-data-via-typosquatting","01125c68-95a4-43d9-8ea5-73a81de2ae19","Fake Braintree NuGet Package Steals Payment Data via Typosquatting","Attackers published a malicious NuGet package named 'Braintree.Net' designed to impersonate PayPal's official Braintree SDK, intercepting live payment card data (PAN, CVV, expiration dates) and harvesting merchant API credentials at runtime. The attackers artificially inflated download counts to ~14 million by publishing 120 empty placeholder versions, creating a false sense of legitimacy and making the package appear widely trusted. This attack exploits the inherent trust developers place in package repositories and the lack of rigorous verification before integrating third-party dependencies into payment-critical applications. The impact is severe: any merchant application that installed the malicious versions was effectively a live skimmer, exfiltrating sensitive cardholder data directly to attacker-controlled infrastructure, triggering potential PCI DSS breach obligations.","**Immediate actions:**\n- Audit all NuGet dependencies in payment-related projects and verify package names, publisher identity, and digital signatures against official sources.\n- Remove any versions of Braintree.Net (3.35.8–3.36.1) immediately, rotate all exposed merchant API keys, and treat any processed payment card data as compromised.\n- Block outbound traffic to known attacker infrastructure (api.348672-shakepay[.]com) at the perimeter firewall.\n\n**Long-term improvements:**\n- Enforce a vetted, internal package mirror or allowlist so developers can only consume pre-approved, organization-approved NuGet packages.\n- Integrate software composition analysis (SCA) tools (e.g., Sonatype, Snyk, GitHub Dependabot) into CI\u002FCD pipelines to flag typosquatted or suspicious packages before they reach production.\n- Establish a formal third-party dependency review process that validates publisher identity, repository provenance, and code integrity for all packages used in payment or credential-handling contexts.\n\n**Detection measures:**\n- Monitor egress network traffic for anomalous outbound connections from application servers, especially to unknown or newly registered domains.\n- Enable runtime application security monitoring (RASP) or behavioral analysis to detect unexpected data exfiltration patterns from payment processing services.\n- Continuously scan production environments for known malicious package hashes using threat intelligence feeds integrated with your SIEM or CNAPP platform.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST CSF DE.CM-8: Vulnerability Scans","PCI DSS v4.0 Requirement 6.3: Security Vulnerabilities in Bespoke and Custom Software","PCI DSS v4.0 Requirement 12.8: Manage Third-Party Service Provider Risks","SLSA (Supply-chain Levels for Software Artifacts) Framework Level 2+","OWASP A06:2021 – Vulnerable and Outdated Components",{},"published","2026-07-09T23:20:24.698889+00:00","2026-07-09T23:20:24.369+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fsocket.dev\u002Fblog\u002Fbraintree-nuget-typosquat-skims-credit-cards?utm_medium=feed","fake-braintree-nuget-package-skims-credit-cards-and-harvests-merchant-credential-4e92ad","Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[44,50],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"4362059e-abbb-4847-960c-595c65c6138d","2026-07-11","afternoon","ThreatNoir Weekend Brief — July 11","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-07-11\u002Fthreatnoir-afternoon-brief-2026-07-11.mp3",{"id":51,"date":52,"edition":53,"title":54,"audio_url":55},"44fe18fd-1e68-4941-bb74-9275a4a4269e","2026-07-10","morning","ThreatNoir Morning Brief — July 10","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-07-10\u002Fthreatnoir-morning-brief-2026-07-10.mp3",[57,61,64],{"slug":58,"name":59,"problem":60},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":34,"name":62,"problem":63},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":65,"name":66,"problem":67},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]