Fake Braintree Package Steals Credit Cards Only in Production to Avoid Detection

A highly sophisticated malware campaign was recently discovered lurking within the NuGet ecosystem, targeting developers who use the popular Braintree payment gateway. Security researchers at Socket flagged a malicious package named “Braintree.Net,” which masquerades as the official Braintree .NET library maintained by PayPal. First published in early July 2026, this imposter package uses a clever […] The post Fake Braintree Package Steals Credit Cards Only in Production to Avoid Detection appeared first on Cyber Security News.

A highly sophisticated malware campaign was recently discovered lurking within the NuGet ecosystem, targeting developers who use the popular Braintree payment gateway. Security researchers at Socket flagged a malicious package named “Braintree.Net,” which masquerades as the official Braintree .NET library maintained by PayPal. First published in early July 2026, this imposter package uses a clever naming variation and fake download counts to trick developers into installing it. Once integrated into a project, it quietly intercepts live payment card data and steals sensitive system secrets. The official package is named “Braintree.” The attackers created “Braintree.Net” to snare victims who might slightly mistype the name or copy the wrong installation command. To make the trap look authentic, the creators inflated its download statistics. They published over a hundred empty placeholder versions in a single day, artificially boosting the total download count to 14 million. In reality, the genuinely malicious versions have only seen a few hundred actual installations. The package even copies the legitimate Braintree documentation for its readme file, further completing the disguise. Production-Only Braintree Card Skimmer (Source: socket) Production-Only Braintree Card Skimmer What makes this malicious package particularly dangerous is its ability to blend in and evade detection during normal testing. The malware includes built-in checks to ensure it only activates its most harmful features when the application is running in a live production environment. If a developer is testing the integration in a sandbox or development environment, the data theft code remains completely dormant. This ensures the integration passes standard quality assurance tests without raising any red flags. Once deployed to production, the package initiates three distinct paths for stealing information. First, it intercepts payment card details directly from the application’s memory. A hidden logger captures the full primary account number, card verification value, and expiration date before the payment request is sent to the real Braintree servers. Production-Only Braintree Card Skimmer (Source: socket) Second, it steals the merchant’s private API keys the moment they are configured in the code. Finally, the malware uses a companion dependency, “DependencyInjector.Core,” to harvest environment variables and configuration files. All stolen information is bundled and sent to a remote server controlled by the attackers, hosted on a fake domain. To prevent the application from crashing and alerting developers, the malware wraps all its data-theft operations in empty error-handling blocks. Even if the network connection to the attacker’s server fails, the host application continues processing payments as if nothing were wrong, Socket said. Indicators of Compromise IOC TypeValueDescriptionFile Hash (SHA-256)7a9f19ed663c1d4ee259ba0a10e93e1c9770812ce81f8c945140a452d17cb3c8Braintree.dllFile Hash (SHA-256)f181d57c29364aef01e3f72051ec2dc0da918d346e7e4d1377e13408afb8663aBraintree.dll Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM. Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google. The post Fake Braintree Package Steals Credit Cards Only in Production to Avoid Detection appeared first on Cyber Security News.