Fake Next.js job interview tests backdoor developer's devices

Bleeping Computer

by Bill Toulas

February 25, 2026

AI-Generated Deep Dive Summary

A coordinated cyberattack campaign targeting software developers has been uncovered, utilizing malicious repositories disguised as legitimate Next.js projects and job-related materials. The attackers created fake web app projects using Next.js, which are shared during job interviews or technical assessments. When developers clone these repositories and follow standard workflows—such as opening the project in VS Code, running the dev server, or starting the backend—the malicious code embedded within triggers remote code execution (RCE), enabling unauthorized access to developer machines. This allows attackers to exfiltrate sensitive data, deploy additional payloads, and gain persistent control over compromised systems. The attack chain involves multiple execution triggers designed to exploit common developer behaviors. For instance, a .vscode/tasks.json file executes malicious scripts as soon as the project folder is opened in VS Code. Similarly, running npm commands or starting the backend server decodes hidden URLs and fetches malicious loaders from remote servers. These actions execute JavaScript payloads directly in memory, bypassing traditional security measures. Once executed, the payload profiles the infected system, connects to a command-and-control (C2) server, and awaits further instructions. A second stage controller then enables file enumeration, process tracking, and additional tasks. This campaign highlights the growing threat of attacks targeting developers, who often have access to sensitive systems and data. The attackers’ sophistication suggests a coordinated effort aimed at long-term compromise rather than quick exploitation. By leveraging trusted tools and workflows—like VS Code and Node.js—the attackers bypass typical security defenses. This underscores the need for developers and organizations to treat standard coding environments as high-risk attack surfaces. To mitigate these risks, Microsoft recommends implementing measures such as enforcing VS Code Workspace Trust/Restricted Mode, applying Attack Surface Reduction (ASR) rules, and minimizing secrets stored on developer machines. Developers should also verify the authenticity

Verticals

securitytech

Originally published on Bleeping Computer on 2/25/2026