Fake Next.js Job Interviews Deliver Backdoors to Developers’ Devices
Summary
Microsoft researchers describe a coordinated campaign using fake Next.js projects and coding tests to target developers. Opening or running malicious repositories can trigger in-memory JavaScript backdoors that enable remote code execution and staged data exfiltration.
Key points
- Attackers use fake Next.js projects and recruiting coding tests to persuade developers to clone malicious repositories.
- Repositories include VS Code folder-open tasks, trojanized development-server assets, or backend startup code that can trigger JavaScript loaders.
- Loaders fetch and execute a JavaScript backdoor in memory within the Node.js process.
- A first-stage payload profiles the host and registers with a command-and-control server; a second-stage controller can execute JavaScript, enumerate files, and stage exfiltration.
- Microsoft found multiple repositories with shared code structure, loader logic, and naming patterns, indicating a coordinated campaign; the attacker and operation’s extent were not identified.
- Recommended mitigations include enforcing VS Code Workspace Trust or Restricted Mode, applying Attack Surface Reduction rules, monitoring risky sign-ins, and minimizing long-lived secrets on developer devices.
Article Details
- Attack Vectors
- Job-interview and technical-assessment lures distribute malicious Bitbucket repositories disguised as Next.js projects and coding tests.
- Opening a trusted project folder triggers a Node.js script through a VS Code tasks.json task configured with runOn: "folderOpen".
- Running npm run dev invokes a trojanized development-server asset that decodes a hidden URL and fetches a loader.
- Backend startup code decodes an endpoint from .env, sends process.env to the server, and executes returned JavaScript.
- JavaScript loaders retrieve and execute an in-memory backdoor in the running Node.js process; later stages support task execution, file enumeration, and staged exfiltration.
- Defensive Notes
- Enforce VS Code Workspace Trust and Restricted Mode.
- Use Attack Surface Reduction (ASR) rules.
- Monitor risky sign-ins with Entra ID Protection.
- Minimize secrets stored on developer endpoints; prefer short-lived tokens with the least required privileges.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe campaign decodes hidden URLs and a base64-encoded endpoint before using them.T1041 · Exfiltration Over C2 ChannelThe payload supports staged file exfiltration to the campaign's command-and-control infrastructure.T1059.007 · JavaScriptJavaScript loaders and the backdoor execute JavaScript, including code returned by the tasking controller, within the Node.js process.T1083 · File and Directory DiscoveryThe Stage 2 controller supports file enumeration and directory browsing.T1105 · Ingress Tool TransferThe loaders fetch additional malicious code from remote servers for staged payload delivery.
Vendors
Products
BitbucketA coordinated campaign targets software developers by publishing malicious Bitbucket repositories disguised as legitimate Next.js projects and technical assessment materials, including coding tests.Entra ID ProtectionTrust/Restricted Mode, applying Attack Surface Reduction rules, monitoring risky sign-ins with Entra ID Protection, and minimizing long-lived secrets on developer endpoints.Next.jsA coordinated campaign targets software developers by publishing malicious Bitbucket repositories disguised as legitimate Next.js projects and technical assessment materials, including coding tests.Node.jsMalicious JavaScript loaders download a backdoor and execute it in-memory within the Node.js process to achieve remote code execution.VS CodeWhen developers clone and open these repos, embedded triggers (VS Code folderOpen tasks, npm dev assets, or backend startup code) execute JavaScript loaders that fetch in-memory backdoors enabling remote code execution,