# Malicious Next.js Repositories — Developer-Targeting C2 Campaign via VSCode Workspace Abuse, Job-Themed Lures, and Staged JavaScript Execution

> Microsoft Defender Experts identified a coordinated campaign using malicious GitHub/Bitbucket repositories disguised as legitimate Next.js projects and technical assessment materials. Three execution paths (VSCode workspace auto-execution, npm build-time trojanized assets, and backend module dynamic RCE) converge on two-stage JavaScript C2 with in-memory execution, targeting developer systems for source code, environment secrets, and cloud credentials.

- **Published:** 2026-02-24T19:13:00Z
- **Last reviewed:** 2026-02-24T19:13:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0139
- **ID:** TL-2026-0139
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Contagious Interview (North Korea)
- **Detections:** 9 · **IOCs:** 47 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft Defender Experts identified a coordinated developer-targeting campaign delivered through malicious repositories disguised as legitimate Next.js projects and technical assessment materials. The campaign uses job-themed lures to blend into routine developer workflows — particularly recruiting-themed "technical assessments" — and increases the likelihood of code execution by abusing trusted development tools and patterns.

Multiple repository families were identified across GitHub and Bitbucket: Cryptan-Platform-MVP1, JP-soccer, RoyalJapan, and SettleMint, with variant naming conventions (v1, master, demo, platform, server) creating near-duplicate repositories to increase execution probability.

The campaign employs three distinct execution paths that all converge on the same staged C2:

Path 1 — VSCode Workspace Execution: Repositories include .vscode/tasks.json configured with runOn: "folderOpen", triggering automatic execution when a developer opens and trusts the project folder. A dictionary-based fallback provides redundancy. The execution chain retrieves a JavaScript loader from Vercel staging infrastructure (e.g., price-oracle-v2.vercel[.]app) and executes it via Node.js.

Path 2 — Build-Time Execution: Malicious logic embedded in trojanized application assets (e.g., modified jquery.min.js) triggers when developers run npm run dev or start the server. The trojanized asset decodes a base64-encoded URL, retrieves a Vercel-hosted loader, and executes it in-memory.

Path 3 — Server Startup via Environment Exfiltration: Backend modules decode a base64 endpoint from .env (AUTH_API variable), POST the entire process.env to the attacker server (exposing cloud keys, database credentials, API tokens), then execute returned JavaScript via new Function("require", response.data)(require) — achieving in-memory RCE within the Node.js server process.

Stage 1 C2 functions as a lightweight registrar: it profiles the host, polls a registration endpoint at fixed cadence, receives a durable instanceId for correlation, and can execute bootstrap JavaScript via new Function(). Stage 2 upgrades to a persistent tasking controller communicating with separate C2 IPs on port 3000. It polls for messages[] arrays of JavaScript tasks, executes them via separate Node interpreters (piping via STDIN), supports identity rotation, kill switches, error reporting, directory browsing (/api/hsocketNext, /api/hsocketResult), and staged file upload (/upload, /uploadsecond, /uploadend).

The campaign targets developer systems containing high-value assets: source code, environment secrets, SSH keys, cloud credentials, and access to build/deployment infrastructure. Cross-platform (Windows, macOS, Linux) via Node.js runtime.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1566.002 Spearphishing Link
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1072 Software Deployment Tools
- T1546 Event Triggered Execution
- T1554 Compromise Host Software Binary
- T1027 Obfuscated Files or Information
- T1027.007 Dynamic API Resolution
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1218 System Binary Proxy Execution
- T1552.001 Credentials In Files
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1102.001 Dead Drop Resolver
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [Microsoft: Developer-targeting campaign using malicious Next.js repositories](https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/)
- [Jamf: Threat Actors Expand Abuse of Microsoft Visual Studio Code](https://www.jamf.com/blog/threat-actors-expand-abuse-of-visual-studio-code/)
- [The Hacker News: North Korea-Linked Hackers Target Developers via Malicious VS Code Projects](https://thehackernews.com/2026/01/north-korea-linked-hackers-target.html)
- [OpenSource Malware: New DPRK Malware Uses Microsoft VSCode Dictionary Files](https://opensourcemalware.com/blog/contagious-interview-malicious-dictionary)
- [VSCode Workspace Trust Documentation](https://code.visualstudio.com/docs/editing/workspaces/workspace-trust)
- [Microsoft Defender for Endpoint: Attack Surface Reduction Rules](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction)
- [Microsoft Entra ID Protection: Investigate Risk](https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-investigate-risk)
- [MITRE ATT&CK: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0139