Contagious Interview Campaign Uses Fake Developer Interviews to Deliver Malware
Summary
Microsoft describes a campaign using fake developer interviews, malicious packages, and Visual Studio Code tasks to deploy backdoors that steal developer credentials and enable persistent access.
Key points
- Microsoft reports the campaign has been active since at least December 2022 and targets software developers at enterprise solution providers and media and communications firms.
- Attackers pose as recruiters and persuade targets to clone and run malicious NPM packages or trust Visual Studio Code repositories whose task configurations execute payloads.
- Payloads include the Python backdoor Invisible Ferret and modular FlexibleFerret, alongside BeaverTail and OtterCookie in earlier or supporting roles.
- FlexibleFerret supports encrypted HTTP(S) and TCP command-and-control, plugin loading, remote commands, file transfer, reconnaissance, and persistence through Windows RUN registry modifications.
- The malware targets API tokens, cloud credentials, signing keys, cryptocurrency wallets, and password-manager artifacts, potentially exposing source code, CI/CD, and production systems.
- Microsoft recommends isolated interview environments, reviewing recruiter-provided repositories, restricting scripting runtimes, protecting secrets with short-lived credentials and MFA, and hunting for suspicious execution chains.
Article Details
- Attack Vectors
- Attackers use fake recruitment and technical interview workflows to persuade developers to execute malicious NPM packages or commands.
- Malicious packages are hosted in repositories on GitHub, GitLab, or Bitbucket; granting trust to a repository in Visual Studio Code can trigger automatic execution of its task configuration.
- Some fraudulent interview workflows instruct victims to paste and run commands that retrieve payloads using curl or wget, including redirects to payloads hosted on vercel.app.
- Reported payloads include the BeaverTail loader, the OtterCookie beaconing agent, and the Invisible Ferret and FlexibleFerret backdoors.
- The malware is reported to collect developer credentials and other sensitive artifacts, including API tokens, cloud credentials, signing keys, cryptocurrency wallets, and password manager artifacts.
- FlexibleFerret is reported to use encrypted HTTP(S) and TCP command-and-control channels, load plugins, transfer files, and establish persistence through RUN registry modifications.
- Defensive Notes
- Use isolated, non-persistent environments for coding interviews and assignments rather than workstations with access to production credentials or internal repositories.
- Review recruiter-provided repositories before running scripts, installing dependencies, or executing tasks; treat paste-and-run commands and requests to trust unknown repository authors as high risk.
- Restrict scripting and developer runtimes where possible, and monitor execution chains from code editors or developer tools to shells, curl or wget, and script execution.
- Monitor Node.js and Python processes for sensitive-file enumeration, clipboard access, screenshot capture, and HTTP POST uploads.
- Use short-lived credentials and secrets vaults, enforce multifactor authentication and conditional access, and review access to password manager vaults and signing keys.
- If compromise is suspected, isolate the device, rotate potentially exposed credentials and tokens, and review repository and CI/CD access for follow-on activity.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationFlexibleFerret is described as using layered obfuscation.T1041 · Exfiltration Over C2 ChannelFlexibleFerret supports file uploads, and the article describes HTTP POST uploads of collected data.T1057 · Process DiscoveryThe article reports process discovery as part of the malware's discovery activity.T1059.004 · Unix ShellReported stagers use curl or wget piped to a shell to retrieve and execute scripts.T1059.006 · PythonInvisible Ferret is a Python-based backdoor, and the article describes Python execution in the related payload chain.T1059.007 · JavaScriptMalicious NPM packages and Node.js agents are used in the reported execution and beaconing activity.T1071.001 · Web ProtocolsFlexibleFerret uses encrypted HTTP(S) command-and-control channels.T1082 · System Information DiscoveryThe backdoors gather basic system information and enumerate environment details for reconnaissance.T1105 · Ingress Tool TransferCommands launched from malicious packages or interview instructions retrieve follow-on scripts and payloads from remote hosts.T1113 · Screen CaptureThe article reports screenshot capture as part of malware data collection and reconnaissance.T1115 · Clipboard DataNode.js activity associated with OtterCookie monitors and reads clipboard contents.T1204.002 · Malicious FileVictims are induced to clone and execute malicious NPM packages or run tasks from recruiter-provided repositories.T1547.001 · Registry Run Keys / Startup FolderFlexibleFerret establishes persistence by modifying RUN registry keys.
People
Malware
BeaverTailFollow-on payloads include Python-based Invisible Ferret and the modular FlexibleFerret (Go and Python variants), with earlier use of BeaverTail as a loader and OtterCookie as a beaconing agent.FlexibleFerretmalicious NPM packages and Visual Studio Code tasks, delivering backdoors like Invisible Ferret and FlexibleFerret.InvisibleFerretinto running malicious NPM packages and Visual Studio Code tasks, delivering backdoors like Invisible Ferret and FlexibleFerret.OtterCookieFollow-on payloads include Python-based Invisible Ferret and the modular FlexibleFerret (Go and Python variants), with earlier use of BeaverTail as a loader and OtterCookie as a beaconing agent.
Vendors
Products
Microsoft Defender XDRMicrosoft Defender XDR detectionsMicrosoft SentinelMicrosoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious domain indicators mentioned in this blog post with data in theirNode.js[T1056.003] Input Capture: Clipboard Data – OtterCookie/Node.js agents monitor and collect clipboard contents for credential and wallet harvesting (‘Clipboard data read by Node.js script’).VSCodeuses fake technical interview workflows to trick developers into running malicious NPM packages and Visual Studio Code tasks, delivering backdoors like Invisible Ferret and FlexibleFerret.
Industries
Enterprise solution providerswith this campaign in recent customer environments, targeting software developers at enterprise solution providers and media and communications firms by abusing the trust inherent in modern recruitmentmedia and communicationsrecent customer environments, targeting software developers at enterprise solution providers and media and communications firms by abusing the trust inherent in modern recruitment workflows.