Job-Themed Malicious Code Repositories Target Developers With Multi-Stage Backdoors

Microsoft reported an ongoing social-engineering campaign targeting software developers with job-themed lures that direct victims to trojanized code repositories (including Next.js-branded projects and “technical assessment” materials). The repositories are designed to trigger remote code execution and then retrieve and execute attacker-controlled JavaScript that transitions into a staged backdoor with persistent command-and-control (C2), aligning with tradecraft previously associated with North Korea-linked fake recruitment activity.

Separately, researchers also disclosed a software supply-chain campaign involving malicious NuGet packages that targeted ASP.NET developers by stealing ASP.NET Identity data (e.g., user accounts, roles, and permission mappings) and modifying authorization logic to maintain access; one package acted as a dropper that installed a localhost proxy on 127.0.0.1:7152 to relay traffic to an external C2 resolved dynamically at runtime. Other items in the set are unrelated (e.g., generic industry commentary, venture funding news, and incident roundups) and do not add technical detail to the developer-focused repository backdoor campaign described by Microsoft.