Braintree.Net NuGet Typosquat Uses XOR-Obfuscated WebSocket/HTTPS C2 to Exfiltrate Live Payment Card Data and Merchant Credentials
Braintree.Net NuGet Typosquat Uses XOR-Obfuscated (TL-2026-1165), also tracked as Braintree.Net NuGet Supply Chain Attack, is a high-severity supply-chain compromise, first published 2026-07-10. It has no confirmed attribution, affects nuget.org (publisher account: braintree) Braintree.Net (malicious, maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-1165
- Threat ID
- TL-2026-1165
- Also known as
- Braintree.Net NuGet Supply Chain Attack
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-10
- Last reviewed
- 2026-07-10
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, ecommerce, technology, retail
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Braintree.Net NuGet Typosquat Uses XOR-Obfuscated
Malware and tooling: XOR string obfuscation (custom, non-standard encoding)
A malicious NuGet package (Braintree.Net) impersonating PayPal Braintree's official .NET payment SDK was published to nuget.org on July 3, 2026 and flagged by Socket's automated scanner within 10 minutes. The package mimics Braintree's public API surface (BraintreeGateway, CreditCardGateway, TransactionGateway) closely enough that transactions still succeed while three independent exfiltration paths silently harvest full card data (PAN, CVV, expiration, card type), merchant API credentials, environment variables, appsettings*.json contents, cloud instance metadata, and service account tokens.
How Braintree.Net NuGet Typosquat Uses XOR-Obfuscated works
On July 3, 2026, an actor operating the nuget.org publisher account 'braintree' released a package named Braintree.Net at version 3.36.1 — deliberately trailing the legitimate Braintree package's 5.x release line to look like an older-but-plausible version. Socket's automated scanning flagged the package as potential malware within ten minutes of publication, and Socket's Threat Research team subsequently performed manual analysis and public disclosure (corroborated by Cyber Security News and GBHackers reporting on the same date).
The package closely mimics the legitimate Braintree .NET SDK's public API surface, exposing types such as BraintreeGateway, CreditCardGateway, and TransactionGateway that behave enough like the real SDK that developer code calling CreditCardGateway.Create() or configuring BraintreeGateway still functions and returns plausible Result<T> objects — masking the presence of the implant from casual functional testing.
Three independent, silent exfiltration paths are implemented: 1. A module-initializer that executes automatically when the assembly loads, regardless of whether payment operations ever run. It enumerates and reports environment variables, the contents of appsettings*.json configuration files, cloud instance metadata (consistent with IMDS-style queries against cloud provider metadata services), and the full list of loaded assemblies and NuGet dependencies present in the process. 2. An instrumented BraintreeGateway.PrivateKey setter that intercepts and POSTs merchantId, publicKey, and privateKey to attacker infrastructure whenever the gateway is configured for a production environment — the malware explicitly checks for production indicators before activating this collection path, allowing it to stay dormant and undetected during test/dev/sandbox use and automated security scanning that runs in non-production contexts. 3. A CardOperationLogger hook attached to payment-flow methods such as CreditCardGateway.Create and related transaction methods, capturing PAN, CVV/CVC, card expiration date, card type, customer IDs, and transaction amounts as they pass through legitimate payment operations, then POSTing them to a dedicated card-exfiltration endpoint.
The malware family introduces a companion transitive dependency, DependencyInjector.Core, which functions as a token/secret harvester targeting .NET 8–10 application targets and is pulled in automatically when Braintree.Net is installed, widening the blast radius beyond the top-level package.
Network communications are split between plaintext and obfuscated channels: card and account exfiltration endpoints (/api/card, /api) are called in plaintext HTTP(S) POST requests to api.348672-shakepay[.]com, a domain resolving to Cloudflare anycast IPs (masking the true origin server behind Cloudflare's reverse proxy) and using a brand name (shakepay) unaffiliated with the real Shakepay cryptocurrency exchange to appear legitimate in traffic logs. Separately, telemetry/beacon endpoints inside the DependencyInjector.Core payload are XOR-obfuscated at rest and decoded at runtime — consistent with the same actor family's technique observed in a related, contemporaneous NuGet typosquat campaign against the Nethereum Ethereum SDK (packages Netherеum.All and NethereumNet, published via accounts nethereumgroup / NethereumCsharp), where a 44-byte XOR mask decodes an embedded character array (e.g. "jwwrs:./ronaoanettorkinstance[.]info/api/gads" -> "hxxps://solananetworkinstance[.]info/api/gads") and secrets are POSTed as HTTPS form data via a Shuffle(string) method. Separately, the originating Cyber Security News source article for this specific Braintree threat additionally reports XOR-obfuscated C2 destination concealment reached via a WebSocket channel (wss://wordpressws.com/ws), indicating the campaign/malware family uses more than one C2 transport and destination across build variants or delivery stages — network defenders should treat both wordpressws[.]com and 348672-shakepay[.]com as related indicators for this package family pending further confirmation of exact build-to-endpoint mapping.
Every exfiltration call across all three paths is wrapped in empty catch blocks so that network failures — e.g. an EDR-blocked outbound connection or a broken DNS resolution — fail completely silently, leaving no exception trace, error log entry, or crash that would tip off a defender or developer.
Socket reports the malicious package accrued roughly 14 million cumulative downloads across the publisher's overall package set, though the confirmed-malicious Braintree.Net releases themselves saw only a few hundred confirmed installs. The bulk of the download count is explained by a padding scheme: the same publisher account published 120 throwaway 0.0.x versions on 2025-10-09, each accruing roughly 93,300 downloads — a technique consistent with inflating apparent package popularity/trust signals (via bot or automated-download farms) ahead of, or alongside, the malicious release, so that reputation-based screening tools see a large, established download base rather than a brand-new suspicious package. The same 'braintree' publisher account is also observed publishing typosquat packages targeting the SIPSorcery SIP/WebRTC ecosystem, indicating a broader multi-target campaign rather than a single one-off package.
At time of reporting, no CVE has been assigned (this is a malicious/typosquat package, not a vulnerability in the legitimate Braintree SDK) and no CVSS score applies. Socket has reported the package to NuGet and requested takedown and publisher-account suspension; removal/takedown completion status was not confirmed as of the source reporting date.
MITRE ATT&CK techniques used in TL-2026-1165
Collection
T1005 Data from Local System; T1119 Automated Collection; T1213 Data from Information Repositories
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070 Indicator Removal; T1497.001 System Checks
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Command and Control
T1071.001 Web Protocols; T1090.004 Domain Fronting; T1132.001 Standard Encoding
Discovery
T1082 System Information Discovery; T1518 Software Discovery; T1580 Cloud Infrastructure Discovery
Initial Access
T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Execution
Persistence
Credential Access
T1528 Steal Application Access Token; T1552.001 Credentials In Files
privilege-escalation
T1546 Event Triggered Execution
Resource Development
T1583.001 Domains; T1585 Establish Accounts; T1587.001 Malware
Impact
Affected products and versions in Braintree.Net NuGet Typosquat Uses XOR-Obfuscated
- nuget.org (publisher account: braintree) — Braintree.Net (malicious typosquat package)
Vulnerable versions: 3.36.1; 0.0.x throwaway padding releases - nuget.org (publisher account: braintree) — DependencyInjector.Core (companion transitive malicious dependency)
Vulnerable versions: all published versions targeting .NET 8-10 - PayPal / Braintree — Braintree (legitimate .NET SDK, unaffected but impersonated)
Fixed in: 5.x (legitimate current line, published by braintreepayments)
Remediation for Braintree.Net NuGet Typosquat Uses XOR-Obfuscated
Patches
- No patch applicable — remove the malicious Braintree.Net package entirely and replace with the legitimate 'Braintree' package (maintained by braintreepayments / PayPal, current 5.x line) sourced from the verified publisher
Immediate actions
- Audit direct and transitive NuGet dependencies for the package name Braintree.Net (and its transitive dependency DependencyInjector.Core) and remove immediately if present
- Block/deny outbound network traffic to api.348672-shakepay.com and wordpressws.com at the perimeter and via EDR/DNS filtering
- Treat any merchant API credentials (merchantId, publicKey, privateKey) that were ever loaded in a process referencing Braintree.Net as compromised and rotate them immediately
- Treat all payment card data (PAN, CVV, expiration) processed through an affected application as compromised and follow PCI-DSS incident response / card-brand notification procedures
- Rotate any environment variables, appsettings*.json secrets, cloud instance credentials, and service account tokens present on hosts that ran the affected package
- Review outbound connection logs for POST requests to /api/card or /api on the identified C2 domains, and for any WebSocket connections to wss://wordpressws.com/ws
Workarounds
- Verify NuGet package publisher identity and package ID exactly matches 'Braintree' (not 'Braintree.Net' or similar variants) before installing or updating
Longer-term hardening
- Pin NuGet dependencies to explicit package IDs from verified/known publishers rather than resolving by name similarity
- Adopt lock files (packages.lock.json) and reproducible restore to prevent silent transitive dependency swaps
- Implement automated software composition analysis (SCA) / malicious-package scanning (e.g. Socket, equivalent SCA tooling) in CI for all new and updated NuGet dependencies
- Restrict which NuGet publisher accounts/package sources are trusted via an internal package proxy or allowlist
- Monitor outbound traffic from payment-processing applications for anomalous destinations, including newly-registered or brand-impersonating domains
Weaknesses (CWE) in Braintree.Net NuGet Typosquat Uses XOR-Obfuscated
CWE-506, CWE-829, CWE-311, CWE-522, CWE-1104
Timeline of Braintree.Net NuGet Typosquat Uses XOR-Obfuscated
- Publisher account 'braintree' publishes 120 throwaway 0.0.x versions of the package line, each accruing roughly 93,300 downloads, inflating the account's apparent overall download/reputation footprint ahead of the malicious release.
- Socket reports the malicious package to NuGet and requests removal and suspension of the 'braintree' publisher account; confirmed takedown completion status not reported.
- Socket Threat Research team performs manual analysis, identifying three independent exfiltration paths (module initializer, BraintreeGateway.PrivateKey setter hook, CardOperationLogger payment-flow hook), the companion DependencyInjector.Core transitive dependency, XOR-obfuscated telemetry endpoints, and the api.348672-shakepay[.]com C2 infrastructure.
- Socket's automated scanning pipeline flags Braintree.Net as potential malware within approximately 10 minutes of publication.
- Malicious package Braintree.Net version 3.36.1 is published to nuget.org under the publisher account 'braintree', typosquatting the legitimate 'Braintree' SDK maintained by braintreepayments/PayPal.
- Threat ingested into TL-Intel-Harness backlog via RSS hunt phase (source: Cyber Security News feed) as TL-2026-1165.
- GBHackers publishes corroborating technical disclosure detailing package version, download metrics, the three exfiltration vectors, and the api.348672-shakepay[.]com C2 domain.
- Cyber Security News publishes public disclosure of the campaign, additionally reporting a WebSocket-based C2 channel (wss://wordpressws.com/ws) concealed via XOR obfuscation and production-environment activation checks.
Sources cited for Braintree.Net NuGet Typosquat Uses XOR-Obfuscated
Threats related to Braintree.Net NuGet Typosquat Uses XOR-Obfuscated
- npm Supply Chain Attack: @injectivelabs/sdk-ts v1.20.21 and 17 Sibling Packages Infected with Cryptocurrency Wallet Stealer
- Binding.gyp "Phantom Gyp" Supply Chain Attack (Miasma Worm) Enables CI/CD Worm Propagation Across 57 npm Packages
- CodeTracer: Forensic Attribution Tool for Backdoored AI Code-Completion Models
- Miasma Malware Supply Chain Attack Targets npm Packages, Go Module, and GitHub Actions CI/CD Pipelines
- Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp" Trick and Bun Runtime to Steal Developer Credentials Across npm, Go, and RubyGems
- jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)
Detection coverage for TL-2026-1165
As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1165 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.