Poisoned Pipeline / Incidents / AS150

AS150 · 2026-06

NuGet Sicoob SDK impersonation

NuGet

Socket: malicious NuGet package impersonates the Sicoob SDK to
exfiltrate banking certificates and passwords.

Mapped techniques

• T0136 Brandjacking
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://socket.dev/blog/malicious-nuget-package-impersonates-sicoob-sdk