Microsoft Warns Developers of Fake Next.js Job Repos Delivering In-Memory Malware
Malicious repositories masquerading as authentic Next.js projects and technical evaluations are being used in a coordinated developer-targeting operation to deceive victims into running them and gain long-term access to compromised systems.
According to a research released this week by the Microsoft Defender Security Research Team, the activity is consistent with a larger cluster of attacks that use job-themed lures to blend into regular developer workflows and raise the risk of code execution.
The campaign, according to the tech giant, is distinguished by the use of several entry points that result in the same consequence, where attacker-controlled JavaScript is obtained at runtime and executed to enable command-and-control (C2).
Threat actors use identities like "Cryptan-Platfo...