Fake Next.js Job Interviews Target Developers with Backdoor Malware

A sophisticated malware campaign is targeting software developers through fake job interview processes, using malicious Next.js repositories to compromise developer machines and steal sensitive data. The attack, discovered by Microsoft Defender researchers, represents a concerning evolution in social engineering tactics that exploit the trust inherent in professional recruitment processes.

The Attack Vector

The attackers create counterfeit Next.js projects that appear legitimate, posing as coding assessments or technical interview materials. Next.js, a popular JavaScript framework for building web applications that runs on top of React with Node.js for backend functionality, provides an ideal cover for these malicious repositories.

When developers clone these repositories and follow standard workflows, they unknowingly trigger malicious JavaScript execution. The attack chain is particularly insidious because it exploits normal development practices rather than requiring any unusual actions from the victim.

Multiple Infection Triggers

Microsoft identified several execution vectors embedded within the malicious repositories:

VS Code Trigger: A .vscode/tasks.json file configured with runOn: "folderOpen" automatically executes a Node script when the project folder is opened and trusted by the developer.

Development Server Trigger: Running npm run dev activates a trojanized asset, typically a modified JavaScript library. This asset decodes a hidden URL, fetches a loader from the attacker's server, and executes it directly in memory.

Backend Startup Trigger: When the server starts, a backend module decodes a base64 endpoint from the .env file, sends environment variables to the attacker, receives JavaScript in response, and executes it using new Function().

The Payload Architecture

Once executed, the infection drops a JavaScript payload (Stage 1) that profiles the compromised host and registers with a command-and-control (C2) endpoint. This stage polls the server at fixed intervals, establishing persistent communication.

The infection then upgrades to a tasking controller (Stage 2) that connects to a separate C2 server. This advanced stage checks for tasks, executes supplied JavaScript in memory, and tracks spawned processes. The payload includes capabilities for file enumeration, directory browsing, and staged file exfiltration.

Coordinated Campaign Evidence

Microsoft's analysis revealed multiple repositories sharing naming conventions, loader structure, and staging infrastructure. This pattern indicates a coordinated effort rather than isolated incidents, suggesting organized threat actors behind the campaign.

The researchers did not disclose specific details about the attackers or the full scope of the operation, but the sophistication and coordination point to well-resourced malicious actors targeting the developer community.

Security Implications

This campaign highlights a critical vulnerability in developer workflows: the assumption that standard development practices are inherently safe. The attack demonstrates how threat actors can weaponize routine activities like opening project folders, running development servers, or starting backend services.

Developers often work with numerous repositories and projects, sometimes from unverified sources, making them particularly vulnerable to such attacks. The use of job interview contexts adds an additional layer of trust that attackers exploit.

Recommended Mitigations

Microsoft advises developers to treat standard workflows as high-risk attack surfaces and implement appropriate safeguards:

• Enforce VS Code Workspace Trust/Restricted Mode: This feature prevents automatic execution of potentially malicious code when opening unfamiliar projects.
• Implement Attack Surface Reduction (ASR) rules: These rules can block suspicious behaviors and execution patterns.
• Monitor risky sign-ins with Entra ID Protection: Enhanced monitoring can detect anomalous access patterns that may indicate compromise.
• Minimize secrets on developer endpoints: Reduce the potential impact of a successful compromise by limiting stored credentials and tokens.
• Use short-lived tokens with least privileges: Implement the principle of least privilege with time-limited access tokens to contain potential damage.

Industry Context

This attack aligns with broader trends in targeting software developers, who often have elevated system access and work with sensitive codebases. Similar campaigns have used malicious AI extensions in the VSCode Marketplace to steal developer data, demonstrating the persistent targeting of this demographic.

The sophistication of this campaign—using legitimate frameworks, multiple execution vectors, and staged payloads—reflects the evolving nature of cyber threats against the software development community.

The incident serves as a stark reminder that even routine professional activities like job interviews can be weaponized by determined attackers, necessitating a security-first approach to all development workflows.