Microsoft Defender Experts have uncovered a sophisticated and coordinated attack campaign aimed at developers through malicious Next.js repositories. These repositories are disguised as legitimate job assessment projects and leverage various methods to execute backdoors and access sensitive information from the developer’s systems.
The campaign employs three primary execution paths:
<ol>
<li>
VS Code Workspace Automation: By manipulating the <code>.vscode/tasks.json</code> file to run automatically when a folder is opened, attackers can initiate malicious scripts without noticeable triggers.
</li>
<li>
Trojanized Build-Time Assets: Assets like <code>jquery.min.js</code> are modified to execute malicious code during the build process, specifically triggered when developers run <code>npm run dev</code>.
</li>
<li>
Backend Module Imports: These imports are designed to exfiltrate environment variables and execute attacker-supplied JavaScript through dynamic compilation, often utilizing base64-encoded <code>.env</code> endpoints.
</li>
</ol>
All these paths converge on a sophisticated two-stage Command and Control (C2) architecture. The first stage is responsible for registering the victim machine and bootstrapping additional malicious code in-memory. The second stage provides persistent control over the victim’s machine, allowing for operator-directed tasks, directory enumeration, and staged file exfiltration.
Post-compromise actions observed include credential theft, session hijacking, and the exfiltration of <code>.env</code> secrets such as AWS keys and GitHub tokens. The campaign has been spotted using Vercel-hosted staging domains and specific IP addresses for C2 communication.
Mitigation strategies are crucial to protect against such threats. Developers are advised to use VS Code Restricted Mode, carefully review configuration files before trusting repositories, conduct assessments within virtual machines rather than on host systems, and monitor for unusual Node.js outbound connections.
For security researchers and IT professionals, Microsoft Defender offers extensive detection coverage with its XDR capabilities and provides KQL hunting queries to identify compromised systems and detect indicators of compromise.

Collections

Microsoft Defender Experts have identified a targeted attack campaign against developers using malicious Next.js repositories disguised as job assessment projects. The attack uses three execution paths: VS Code workspace automation via `.vscode/tasks.json`, trojanized build-time assets like `jquery.min.js`, and backend module imports that exfiltrate environment variables. All paths feed into a two-stage C2 architecture enabling credential theft, session hijacking, and exfiltration of secrets like AWS keys and GitHub tokens. Vercel-hosted staging domains are used for C2 communication. Developers are advised to use VS Code Restricted Mode, review config files before trusting repos, run assessments in VMs, and monitor for unusual Node.js outbound connections.

Malicious Next.js Repositories in Fake Job Assessments Targeting Developers