# Braintree.Net NuGet Typosquat Uses XOR-Obfuscated WebSocket/HTTPS C2 to Exfiltrate Live Payment Card Data and Merchant Credentials

> A malicious NuGet package (Braintree.Net) impersonating PayPal Braintree's official .NET payment SDK was published to nuget.org on July 3, 2026 and flagged by Socket's automated scanner within 10 minutes. The package mimics Braintree's public API surface (BraintreeGateway, CreditCardGateway, TransactionGateway) closely enough that transactions still succeed while three independent exfiltration paths silently harvest full card data (PAN, CVV, expiration, card type), merchant API credentials, environment variables, appsettings*.json contents, cloud instance metadata, and service account tokens.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1165
- **ID:** TL-2026-1165
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 3, 2026, an actor operating the nuget.org publisher account 'braintree' released a package named Braintree.Net at version 3.36.1 — deliberately trailing the legitimate Braintree package's 5.x release line to look like an older-but-plausible version. Socket's automated scanning flagged the package as potential malware within ten minutes of publication, and Socket's Threat Research team subsequently performed manual analysis and public disclosure (corroborated by Cyber Security News and GBHackers reporting on the same date).

The package closely mimics the legitimate Braintree .NET SDK's public API surface, exposing types such as BraintreeGateway, CreditCardGateway, and TransactionGateway that behave enough like the real SDK that developer code calling CreditCardGateway.Create() or configuring BraintreeGateway still functions and returns plausible Result<T> objects — masking the presence of the implant from casual functional testing.

Three independent, silent exfiltration paths are implemented:
1. A module-initializer that executes automatically when the assembly loads, regardless of whether payment operations ever run. It enumerates and reports environment variables, the contents of appsettings*.json configuration files, cloud instance metadata (consistent with IMDS-style queries against cloud provider metadata services), and the full list of loaded assemblies and NuGet dependencies present in the process.
2. An instrumented BraintreeGateway.PrivateKey setter that intercepts and POSTs merchantId, publicKey, and privateKey to attacker infrastructure whenever the gateway is configured for a production environment — the malware explicitly checks for production indicators before activating this collection path, allowing it to stay dormant and undetected during test/dev/sandbox use and automated security scanning that runs in non-production contexts.
3. A CardOperationLogger hook attached to payment-flow methods such as CreditCardGateway.Create and related transaction methods, capturing PAN, CVV/CVC, card expiration date, card type, customer IDs, and transaction amounts as they pass through legitimate payment operations, then POSTing them to a dedicated card-exfiltration endpoint.

The malware family introduces a companion transitive dependency, DependencyInjector.Core, which functions as a token/secret harvester targeting .NET 8–10 application targets and is pulled in automatically when Braintree.Net is installed, widening the blast radius beyond the top-level package.

Network communications are split between plaintext and obfuscated channels: card and account exfiltration endpoints (/api/card, /api) are called in plaintext HTTP(S) POST requests to api.348672-shakepay[.]com, a domain resolving to Cloudflare anycast IPs (masking the true origin server behind Cloudflare's reverse proxy) and using a brand name (shakepay) unaffiliated with the real Shakepay cryptocurrency exchange to appear legitimate in traffic logs. Separately, telemetry/beacon endpoints inside the DependencyInjector.Core payload are XOR-obfuscated at rest and decoded at runtime — consistent with the same actor family's technique observed in a related, contemporaneous NuGet typosquat campaign against the Nethereum Ethereum SDK (packages Netherеum.All and NethereumNet, published via accounts nethereumgroup / NethereumCsharp), where a 44-byte XOR mask decodes an embedded character array (e.g. "jwwrs:./ronaoanettorkinstance[.]info/api/gads" -> "hxxps://solananetworkinstance[.]info/api/gads") and secrets are POSTed as HTTPS form data via a Shuffle(string) method. Separately, the originating Cyber Security News source article for this specific Braintree threat additionally reports XOR-obfuscated C2 destination concealment reached via a WebSocket channel (wss://wordpressws.com/ws), indicating the campaign/malware family uses more than one C2 transport and destination across build variants or delivery stages — network defenders should treat both wordpressws[.]com and 348672-shakepay[.]com as related indicators for this package family pending further confirmation of exact build-to-endpoint mapping.

Every exfiltration call across all three paths is wrapped in empty catch blocks so that network failures — e.g. an EDR-blocked outbound connection or a broken DNS resolution — fail completely silently, leaving no exception trace, error log entry, or crash that would tip off a defender or developer.

Socket reports the malicious package accrued roughly 14 million cumulative downloads across the publisher's overall package set, though the confirmed-malicious Braintree.Net releases themselves saw only a few hundred confirmed installs. The bulk of the download count is explained by a padding scheme: the same publisher account published 120 throwaway 0.0.x versions on 2025-10-09, each accruing roughly 93,300 downloads — a technique consistent with inflating apparent package popularity/trust signals (via bot or automated-download farms) ahead of, or alongside, the malicious release, so that reputation-based screening tools see a large, established download base rather than a brand-new suspicious package. The same 'braintree' publisher account is also observed publishing typosquat packages targeting the SIPSorcery SIP/WebRTC ecosystem, indicating a broader multi-target campaign rather than a single one-off package.

At time of reporting, no CVE has been assigned (this is a malicious/typosquat package, not a vulnerability in the legitimate Braintree SDK) and no CVSS score applies. Socket has reported the package to NuGet and requested takedown and publisher-account suspension; removal/takedown completion status was not confirmed as of the source reporting date.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1587.001 Malware
- T1583.001 Domains
- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1204.003 Malicious Image
- T1546 Event Triggered Execution
- T1525 Implant Internal Image
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1497.001 System Checks
- T1070 Indicator Removal
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1580 Cloud Infrastructure Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1090.004 Domain Fronting
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Braintree NuGet Typosquat Uses XOR Obfuscated C2](https://cybersecuritynews.com/braintree-nuget-typosquat-uses-xor-obfuscated-c2/)
- [Malicious Braintree.Net Typosquat Steals PAN, CVV, and Payment Gateway Credentials](https://gbhackers.com/braintree-net-typosquat/)
- [Malicious NuGet Packages Typosquat Nethereum to Exfiltrate Wallet Keys](https://socket.dev/blog/malicious-nuget-packages-typosquat-nethereum-to-exfiltrate-wallet-keys)
- [Braintree Gallery Package (legitimate)](https://www.nuget.org/packages/Braintree)
- [Braintree .NET SDK Documentation - Set Up Your Server](https://developer.paypal.com/braintree/docs/start/hello-server/dotnet/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1165