Malicious Braintree.Net Typosquat Steals PAN, CVV, and Payment Gateway Credentials

A malicious NuGet package masquerading as the official Braintree .NET client on July 3, 2026 and Socket’s automation labeled it potential malware within ten minutes.

The package, published under the misleading name Braintree.Net, is a carefully crafted typosquat that mirrors PayPal Braintree’s legitimate SDK API while containing a multi-stage .NET implant designed to harvest full payment card data, merchant credentials, and host secrets.

Follow-up analysis by the Socket Threat Research team exposes multiple silent exfiltration paths that activate when the assembly loads or when production payment operations execute, sending stolen data to attacker-controlled infrastructure at api.348672-shakepay[.]com.

At first glance Braintree.Net mimics the real Braintree library (official NuGet ID: Braintree, maintained by PayPal/Braintree and currently in the 5.x line).

The typosquat uses a near-identical public API surface types such as BraintreeGateway, CreditCardGateway and TransactionGateway behave enough like the legitimate SDK that developers can run transactions and receive plausible Result<T> objects, masking the implant.

Subtle clues betray the forgery: a mismatched version scheme (3.36.1 vs official 5.x), project metadata pointing to the genuine GitHub repo, and a README copied from official docs that still instructs readers to install the real package name.

The publisher padded download counts across 120 throwaway 0.0.x versions to inflate visibility; real malicious releases have only a few hundred confirmed installs, indicating a small but real blast radius.

Braintree.Net Typosquat

Socket has reported the package to NuGet and requested removal and publisher suspension. See Socket’s technical write-up for affected package versions and analysis details.

The implant implements three independent exfiltration vectors. First, a module-initializer path (and a companion DependencyInjector.Core package) performs broad codebase analysis on assembly load and reports environment, configuration, dependency and cloud metadata back to an analytics endpoint.

Of Braintree.Net‘s ~14M reported downloads, roughly 11M is padding sprayed across 120 throwaway 0.0.x versions with published on a single day (2025-10-09, ~93,300 each). 

This reconnaissance harvests environment variables, appsettings*.json contents, cloud instance metadata and service account tokens, and lists loaded assemblies and NuGet dependencies.

Second, the BraintreeGateway.PrivateKey setter is instrumented to POST merchantId, publicKey and privateKey to the attacker endpoint when the gateway is configured for production, yielding full merchant API credentials that allow transaction creation, refunds and vault access via the real Braintree API.

Third, a CardOperationLogger hooks into payment flows such as CreditCardGateway.Create and related transaction methods to capture PAN, CVV, expiration, card type, customer IDs and amounts and send them to /api/card.

Beyond Braintree.Net, the same braintree nuget.org account publishes a family of SIP/WebRTC packages that typosquat the popular SIPSorcery ecosystem.

Each exfiltration call is wrapped in empty catch blocks so network failures fail silently and the host application continues functioning, making detection harder.

The package hides some telemetry endpoints via XOR obfuscation in the DependencyInjector.Core payload while leaving card and account endpoints in plaintext.

The domain uses a brand name (shakepay) but resolves to Cloudflare anycast IPs, consistent with attacker-controlled hosting rather than legitimate infrastructure.

The malicious family also introduces a companion dependency, DependencyInjector.Core, which serves as a transitive token harvester for .NET 8–10 targets; several typosquat sibling packages add this dependency to broaden reach.

Operational mitigation: audit direct and transitive NuGet packages dependencies for unexpected or similarly named packages, pin to explicit Braintree package IDs (Braintree published under braintreepayments).

Verify package authorship, and scan assemblies for unexpected module initializers, hardcoded endpoints, or new types like CardOperationLogger or DependencyInjectorLoader.

Rotate exposed merchant API keys and inspect production logs for suspicious gateway initializations.

Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide