A coordinated cyberattack campaign is currently targeting software developers by using fake Next.js job interview tests to install backdoors on their devices. Attackers pose as recruiters and invite candidates to complete a “technical assessment” by cloning a malicious repository from GitHub.

How the Attack Works

The malware is designed to blend into a developer’s normal workflow, triggering execution through several common actions:

• Opening the Project: A .vscode/tasks.json file is configured to run a malicious script automatically as soon as the folder is opened in VS Code.
• Running the Dev Server: When the developer executes npm run dev, a trojanized asset—often a modified library or a hidden eval() in next.config.js—fetches a loader from a remote server.
• Backend Startup: Malicious code in backend modules can exfiltrate environment variables and execute JavaScript directly in memory, according to security analysis from The Hacker News.

Malware Capabilities

Once active, the backdoor—often identified as BeaverTail or InvisibleFerret—grants attackers extensive control:

• Data Exfiltration: Steals SSH keys, API tokens, browser credentials, and local database secrets.
• Remote Access: Establishes a persistent connection to a command-and-control (C2) server for remote code execution (RCE).
• Crypto Theft: Specifically targets developers in the cryptocurrency sector to drain wallets, as detailed by CrowdStrike’s threat research.

Red Flags to Watch For

• Unusual Files: Presence of .vscode/tasks.jsonwith runOn: "folderOpen" or obfuscated code in next.config.js.
• Encrypted Communication: Recruiters quickly moving the conversation to Signal, Telegram, or WhatsApp.
• Vague Company Details: Lack of verifiable leadership profiles or official corporate domain emails.