{"id":10923,"date":"2026-02-25T10:03:41","date_gmt":"2026-02-25T10:03:41","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/25\/microsoft-warns-of-hackers-attacking-developers-with-malicious-next-js-repositories\/"},"modified":"2026-02-25T10:03:41","modified_gmt":"2026-02-25T10:03:41","slug":"microsoft-warns-of-hackers-attacking-developers-with-malicious-next-js-repositories","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/25\/microsoft-warns-of-hackers-attacking-developers-with-malicious-next-js-repositories\/","title":{"rendered":"Microsoft Warns of Hackers Attacking Developers with Malicious Next.js Repositories"},"content":{"rendered":"

Microsoft Warns of Hackers Attacking Developers with Malicious Next.js Repositories
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A coordinated attack campaign is actively targeting software developers through malicious repositories disguised as legitimate Next.js projects and technical assessment materials. <\/p>\n

The attackers rely on job-themed lures, presenting fake recruitment challenges that convince developers to clone and run poisoned code on their own machines. <\/p>\n

Once a developer executes the project, it silently connects to attacker-controlled command-and-control (C2) infrastructure, granting hackers remote access to the developer\u2019s system along with any sensitive data stored on it.<\/p>\n

The campaign was first spotted through suspicious outbound network connections originating from Node.js processes on affected developer machines. <\/p>\n

These processes were repeatedly reaching out to known C2 IP addresses, which prompted a deeper review of the execution chains behind those connections. <\/p>\n

By correlating network activity with process telemetry, analysts traced the Node.js execution back to malicious repositories, including one hosted on Bitbucket presented as a recruiting-themed technical assessment<\/a> and another using the naming convention \u201cCryptan-Platform-MVP1.\u201d<\/p>\n

Microsoft Defender Experts and the Microsoft Defender Security Research Team identified a broader cluster<\/a> of related repositories by pivoting on shared code structure, loader logic, and naming patterns. <\/p>\n

Repository families such as \u201cCryptan,\u201d \u201cJP-soccer,\u201d \u201cRoyalJapan,\u201d and \u201cSettleMint\u201d carried near-duplicate variants labeled v1, master, demo, platform, and server. <\/p>\n

This consistent structure helped analysts uncover additional repositories not referenced in observed telemetry but exhibiting the same execution logic and staging infrastructure.<\/p>\n

The scale of this campaign makes it particularly dangerous for development teams operating in corporate environments. <\/p>\n

Developer machines routinely hold access to high-value assets including source code, environment secrets, cloud API keys, database credentials, and build pipelines. <\/p>\n

When untrusted code runs on a corporate device, a single compromise can quickly extend beyond one endpoint and potentially expose an organization\u2019s entire infrastructure.<\/p>\n

This campaign reflects a calculated shift in how attackers approach software supply chain threats. <\/p>\n

By embedding malicious behavior inside what appears to be a normal project, hackers can achieve reliable code execution<\/a> while blending into routine developer workflows, making this a significant threat to development teams worldwide.<\/p>\n

Three Entry Points, One Shared Backdoor<\/strong><\/h2>\n

All three execution paths in this campaign lead to the same result: runtime retrieval and in-memory execution of attacker-controlled JavaScript. <\/p>\n

The first path abuses Visual Studio Code workspace automation. When a developer opens and trusts a project folder, the\u00a0.vscode\/tasks.json<\/code>\u00a0file is pre-configured with\u00a0runOn: \"folderOpen,\"<\/code>\u00a0immediately triggering a Node.js script that fetches a JavaScript loader from a Vercel-hosted staging endpoint. <\/p>\n

After execution, the script begins beaconing to attacker-controlled infrastructure.<\/p>\n

\n
\"Telemetry
Telemetry showing a VS Code-adjacent Node script initiating outbound access to a Vercel staging endpoint (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

The second path fires when a developer starts the development server using\u00a0npm run dev<\/code>. Trojanized assets, such as a modified\u00a0jquery.min.js<\/code>, decode a base64-encoded URL and retrieve the same JavaScript loader from Vercel. <\/p>\n

\n
\"Telemetry
Telemetry showing\u00a0node server \u2013 server.js\u00a0reaching out to a Vercel-hosted staging endpoint (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

The third path triggers on server startup, where malicious backend routes decode a hidden base64 endpoint from a\u00a0.env<\/code>\u00a0file, transmit the full process environment \u2014 including cloud API keys and access tokens \u2014 to the attacker, and execute attacker-supplied JavaScript via dynamic compilation.<\/p>\n

\n
\"Backend
Backend server startup path where a module import decodes a base64 endpoint (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

Once any of these paths fires, a lightweight Stage 1 payload profiles the host and begins polling the C2 server at fixed intervals. <\/p>\n

\n
\"Stage
Stage 1 registrar payload retrieved at runtime and executed by Node.js (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

Stage 2 then takes over, providing persistent operator-driven tasking, directory browsing, sensitive file collection, and staged uploads of stolen data to attacker infrastructure.<\/p>\n

\n
\"Stage
Stage 2 staged upload workflow observed in telemetry (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

Developers should enable Visual Studio Code Workspace Trust and Restricted Mode to block automatic code execution in unknown folders. <\/p>\n

Organizations should apply attack surface reduction rules to prevent obfuscated script<\/a> execution, enforce strong authentication and conditional access for developer accounts, and avoid storing production credentials on development machines. <\/p>\n

Security teams should monitor for unusual Node.js outbound connections using\u00a0DeviceNetworkEvents<\/code>\u00a0and\u00a0DeviceProcessEvents<\/code>\u00a0hunting queries, and perform identity risk triage whenever a developer endpoint compromise is suspected.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post Microsoft Warns of Hackers Attacking Developers with Malicious Next.js Repositories<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Microsoft Warns of Hackers Attacking Developers with Malicious Next.js Repositories A coordinated attack campaign is actively targeting software developers through malicious repositories disguised as legitimate Next.js projects and technical assessment materials. The attackers rely on job-themed lures, presenting fake recruitment challenges that convince developers to clone and run poisoned code on their own machines. Once […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-10923","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10923"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10923"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10923\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10923"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10923"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10923"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}