Malicious Next.js Repositories — Developer-Targeting C2 Campaign via VSCode Workspace Abuse, Job-Themed Lures, and Staged JavaScript Execution — Threadlinqs Intelligence
As of 2026-07-02, Malicious Next.js Repositories — Developer-Targeting C2 Campaign via VSCode Workspace Abuse, Job-Themed Lures, and Staged JavaScript Execution is a critical-severity supply chain threat attributed to Contagious Interview (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 47 indicators of compromise.
Threat ID: TL-2026-0139 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Contagious Interview · North Korea · ESPIONAGE
Microsoft Defender Experts identified a coordinated campaign using malicious GitHub/Bitbucket repositories disguised as legitimate Next.js projects and technical assessment materials. Three execution
Microsoft Defender Experts identified a coordinated developer-targeting campaign delivered through malicious repositories disguised as legitimate Next.js projects and technical assessment materials. The campaign uses job-themed lures to blend into routine developer workflows — particularly recruiting-themed "technical assessments" — and increases the likelihood of code execution by abusing trusted development tools and patterns.
Multiple repository families were identified across GitHub and Bitbucket: Cryptan-Platform-MVP1, JP-soccer, RoyalJapan, and SettleMint, with variant naming conventions (v1, master, demo, platform, server) creating near-duplicate repositories to increase execution probability.
The campaign employs three distinct execution paths that all converge on the same staged C2:
Path 1 — VSCode Workspace Execution: Repositories include .vscode/tasks.json configured with runOn: "folderOpen", triggering automatic execution when a developer opens and trusts the project folder. A dictionary-based fallback provides redundancy. The execution chain retrieves a JavaScript loader from Vercel staging infrastructure (e.g., price-oracle-v2.vercel[.]app) and executes it via Node.js.
Path 2 — Build-Time Execution: Malicious logic embedded in trojanized application assets (e.g., modified jquery.min.js) triggers when developers run npm run dev or start the server. The trojanized asset decodes a base64-encoded URL, retrieves a Vercel-hosted loader, and executes it in-memory.
Path 3 — Server Startup via Environment Exfiltration: Backend modules decode a base64 endpoint from .env (AUTH_API variable), POST the entire process.env to the attacker server (exposing cloud keys, database credentials, API tokens), then execute returned JavaScript via new Function("require", response.data)(require) — achieving in-memory RCE within the Node.js server process.
Stage 1 C2 functions as a lightweight registrar: it profiles the host, polls a registration endpoint at fixed cadence, receives a durable instanceId for correlation, and can execute bootstrap JavaScript via new Function(). Stage 2 upgrades to a persistent tasking controller communicating with separate C2 IPs on port 3000. It polls for messages[] arrays of JavaScript tasks, executes them via separate Node interpreters (piping via STDIN), supports identity rotation, kill switches, error reporting, directory browsing (/api/hsocketNext, /api/hsocketResult), and staged file upload (/upload, /uploadsecond, /uploadend).
The campaign targets developer systems containing high-value assets: source code, environment secrets, SSH keys, cloud credentials, and access to build/deployment infrastructure. Cross-platform (Windows, macOS, Linux) via Node.js runtime.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-94
Target sectors: technology, software-development, cryptocurrency, financial, cloud-services
Target regions: Global, North America, Europe, Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 47 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195.002, T1566.002, T1059.007, T1204.002, T1072, T1546, T1554, T1027, T1027.007, T1140