cyber.hendryadrian.com
Threat Research · microsoft.com

Microsoft Details Campaign Using Malicious Next.js Repositories to Target Developers

· Original article ↗

Summary

Microsoft researchers traced malicious recruiting-themed Next.js repositories to three execution paths—VS Code workspace tasks, trojanized build assets, and backend startup—that run remote JavaScript, expose environment data, and enable staged C2 tasking and file exfil

Key points

  • Microsoft Defender telemetry and repository analysis linked recruiting-themed assessment projects and malicious Next.js repositories to a coordinated developer-targeting campaign.
  • Three execution paths were identified: VS Code workspace tasks triggered on folder open, trojanized assets executed during development, and backend modules that run at startup.
  • The paths retrieve JavaScript from Vercel-hosted staging and execute it in Node.js; the backend path also sends process environment data to an attacker-controlled endpoint.
  • Stage 1 registers and profiles hosts, while Stage 2 provides persistent tasking, directory browsing, and staged file uploads.
  • The article describes telemetry and repository evidence behind the investigation, including related repositories identified through shared naming patterns, code structure, and loader logic.
  • Microsoft recommends restricting trust in unknown VS Code workspaces, reducing script execution exposure, protecting identity and session tokens, and hunting for unusual Node.js network activity and staged uploads.

Article Details

Attack Vectors
  • Malicious repositories disguised as recruiting assessments and Next.js projects trigger execution when a developer opens or trusts a VS Code workspace.
  • Trojanized development assets retrieve and execute remote JavaScript when the project’s development server is started.
  • Backend startup code decodes an endpoint from a .env value, sends process environment data to the server, and executes returned JavaScript in memory.
  • A staged controller polls for tasks, supports directory browsing, and transfers selected files through staged uploads.
Defensive Notes
  • Use VS Code Workspace Trust and Restricted Mode for repositories from unknown sources, and review workspace automation files before granting trust.
  • Reduce script-execution exposure with attack surface reduction rules and monitor unusual Node.js processes, repeated outbound polling, and staged upload activity.
  • If compromise is suspected, contain affected endpoints, investigate process and network telemetry, and assess identity risks and potentially stolen sessions or tokens.
  • Minimize secrets on developer endpoints, use short-lived tokens and least privilege, and separate production credentials from development workstations.

Indicators of compromise

TypeIndicatorContext
DOMAINapi-web3-auth[.]vercel[.]appVercel-hosted delivery and staging domain identified in the article for loader delivery and backend exfiltration.
DOMAINcoredeal2[.]vercel[.]appVercel-hosted delivery and staging domain identified in the campaign’s infrastructure list.
DOMAINip-check-notification-03[.]vercel[.]appVercel-hosted delivery and staging domain identified in the campaign’s infrastructure list.
DOMAINip-check-notification-firebase[.]vercel[.]appVercel-hosted delivery and staging domain identified in the campaign’s infrastructure list.
DOMAINip-check-notification-firebase03[.]vercel[.]appVercel-hosted delivery and staging domain identified in the campaign’s infrastructure list.
DOMAINip-check-notification-rkb[.]vercel[.]appVercel-hosted delivery and staging domain identified in the campaign’s infrastructure list.
DOMAINip-check-wh[.]vercel[.]appVercel-hosted delivery and staging domain identified in the campaign’s infrastructure list.
DOMAINip-checking-notification-firebase111[.]vercel[.]appVercel-hosted delivery and staging domain identified in the campaign’s infrastructure list.
DOMAINip-checking-notification-kgm[.]vercel[.]appVercel-hosted delivery and staging domain listed among infrastructure used across examined repositories.
DOMAINmonobyte-code[.]vercel[.]appVercel-hosted delivery and staging domain listed among infrastructure used across examined repositories.
DOMAINoracle-v1-beta[.]vercel[.]appVercel-hosted delivery and staging domain referenced for the campaign’s loader activity.
DOMAINprice-oracle-v2[.]vercel[.]appVercel-hosted staging domain contacted by Node.js execution paths to retrieve a JavaScript loader.
DOMAINvscodesettingtask[.]vercel[.]appVercel-hosted staging domain associated with VS Code task staging.
IPV4147[.]124[.]202[.]208C2 infrastructure observed in the campaign’s Stage 1 and Stage 2 activity.
IPV4163[.]245[.]194[.]216C2 infrastructure listed among addresses observed across the campaign’s activity.
IPV466[.]235[.]168[.]136C2 infrastructure listed among addresses observed across the campaign’s activity.
IPV487[.]236[.]177[.]9C2 infrastructure used for Stage 1 registration, Stage 2 tasking, discovery, and staged exfiltration.
SHA19ab4045654a6d97762f9ae8bb97d4ecf67fa53abFile hash observed in the analyzed activity set associated with the campaign.
SHA25607ad8525844ce61471e08e8c515b76bf063bac482394152bad814026cd577f69File hash observed in the analyzed repository set and related campaign activity.
SHA25613152dcb3be425e1ce0f085cd733121a4665cf9935cf8867738e3d510a80308aFile hash observed in the analyzed repository set and related campaign activity.
SHA256449e2bf57ab4790427a3a7de3d98b6c540e76190a3d844de2f0e7b66be842b19File hash observed in the analyzed repository set associated with the malicious campaign.
SHA2566d59740d0710da370d5c38ddf88d6912487a1799e4ad09b72d764a3d27ed16b3File hash observed in the analyzed repository set and related campaign activity.
SHA256ddd43e493cb333c1cc5d7cd50a6a5a61ecd89cfa5f4076f62c2adf96748b87f8File hash observed in the analyzed repository set associated with the malicious campaign.
SHA256e4d71aa95be0725c351e9d1d273d35ccdb0a8bdb31a57927c8738431b89788f5File hash observed in the analyzed repository set and related campaign activity.
URLhxxp[:]//87[.]236[.]177[.]9:3000/api/errorMessageC2 endpoint used for repeated beaconing by the campaign’s Node.js processes.
URLhxxp[:]//87[.]236[.]177[.]9:3000/api/handleErrorsC2 tasking endpoint used by the Stage 2 controller.
URLhxxp[:]//87[.]236[.]177[.]9:3000/api/hsocketNextC2 endpoint used for operator-driven directory enumeration.
URLhxxp[:]//87[.]236[.]177[.]9:3000/uploadC2 upload endpoint used in the staged transfer of collected files.
URLhxxp[:]//87[.]236[.]177[.]9:3000/uploadendC2 upload endpoint used to complete staged transfers of collected files.
URLhxxp[:]//87[.]236[.]177[.]9:3000/uploadsecondC2 upload endpoint used in the staged transfer of collected files.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationRepositories used obfuscated JavaScript and base64-encoded endpoints to conceal loader logic and retrieve payloads.T1041 · Exfiltration Over C2 ChannelThe controller transferred collected files to attacker endpoints through a staged upload workflow.T1059.007 · JavaScriptThe campaign retrieved and executed JavaScript in memory through Node.js, including dynamic compilation with new Function().T1071.001 · Web ProtocolsStage 1 and Stage 2 used HTTP callbacks and polling to communicate with C2 endpoints, including over port 300.T1083 · File and Directory DiscoveryStage 2 supported operator-driven directory browsing through paired enumeration endpoints.T1105 · Ingress Tool TransferLoaders and Stage 1 scripts were fetched at runtime from attacker-used Vercel-hosted staging domains.T1195 · Supply Chain CompromiseMalicious repositories disguised as recruiting assessments and legitimate projects delivered loaders and triggered execution.T1204 · User ExecutionOpening or trusting a workspace, or manually starting the development server, triggered execution.T1552.001 · Credentials In FilesBackend loader code transmitted process.env, including values exposed through .env configuration, to an attacker-controlled server.

People

Colin MilliganCredited with contributing to the Microsoft Defender Security Research investigation.

Vendors

MicrosoftMicrosoft Defender experts identified a coordinated developer‑targeting campaign that seeded malicious repositories (presented as Next.js projects and recruiting/assessment materials) which retrieve and executeVercelestablish a Stage 1 registrar and Stage 2 tasking controller enabling discovery and staged file exfiltration

Products

Microsoft Defender AntivirusMicrosoft Defender Antivirus cloud protection provides rapid identification of new and emerging threats using cloud-based intelligence and is recommended to remain enabled.Microsoft Defender for Cloud AppsMicrosoft Defender for Cloud Apps Conditional Access app control can monitor and control browser sessions in real time, and session policies can restrict high-risk actions to reduce exfiltration opportunities duringMicrosoft Defender for EndpointAttack surface reduction rules in Microsoft Defender for Endpoint can constrain risky behaviors frequently abused in this campaign class, such as running obfuscated scripts or launching suspicious scripts that downloadMicrosoft Defender SmartScreenMicrosoft Defender SmartScreen provides reputation-based protection against malicious sites and unsafe downloads and can help reduce exposure to attacker infrastructure and socially engineered downloads.Microsoft Defender XDRMicrosoft Defender XDR detections   Microsoft Entra ID ProtectionMicrosoft Entra ID Protection provides a structured approach to investigate risky sign-ins and risky users and to take remediation actions when compromise is suspected.Microsoft SentinelCentralize monitoring and hunting in Microsoft Sentinel.Node.jsand execute attacker‑controlled JavaScript at runtime via Vercel‑hosted staging endpoints and Node.js interpreters.Vercelestablish a Stage 1 registrar and Stage 2 tasking controller enabling discovery and staged file exfiltrationVSCodePath 1: Visual Studio Code workspace execution

Related Articles