Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials

A malicious NuGet package named 'Braintree.Net' has been identified as a typosquatting campaign targeting developers using the legitimate Braintree payment SDK. The package intercepts live credit card data, steals merchant API credentials, and harvests environment secrets through a multi-stage .NET implant. It exfiltrates sensitive data to attacker-controlled domains and uses obfuscated C2 communications, particularly in companion dependencies like DependencyInjector.Core. The threat relies on production-only gating to avoid detection during development and testing.

AI-extracted · verify before operational use