Microsoft Alerts Developers of Malicious Next.js Repositories Used in Ongoing Hacker Attacks
## Cybersecurity: Malicious Next.js Repositories Targeting Developers
Cybersecurity: Malicious Next.js Repositories Targeting Developers
Microsoft has identified a campaign where threat actors are exploiting malicious Next.js repositories to compromise developers. These repositories appear to be legitimate projects or technical assessments, but are used to deploy a command-and-control (C2) backdoor without traditional malware installers.
The campaign utilizes standard workflows in Visual Studio Code and Node.js. Attackers publish repositories that mimic genuine Next.js projects, enticing developers to open, build, or run them locally. The investigation highlighted suspicious outbound connections from Node.js processes to attacker infrastructure over HTTP port 3000.
Microsoft Defender Experts reported that this is part of a coordinated effort to target developers using job-themed lures, which blend seamlessly into routine coding tasks. Analysis traced the activity back to Bitbucket-hosted repositories with naming conventions such as "Cryptan", "JP-soccer", "RoyalJapan", and "SettleMint". These repositories share identical loader logic and staging infrastructure.
The malicious repositories exhibit three execution paths converging on runtime retrieval and in-memory execution of attacker-controlled JavaScript:
Microsoft has identified a campaign where threat actors are exploiting malicious Next.js repositories to compromise developers.
Some variants exploit Visual Studio Code workspace automation by configuring .vscode/tasks.json with runOn set to "folderOpen", initiating a Node.js task upon project opening. Build-time execution occurs when developers run npm run dev or start the Next.js server, where trojanized assets like jquery.min.js act as loaders. Server startup execution is achieved through backend routes and environment variables, with .env entries storing base64-encoded endpoints.
All paths lead to a common Stage 1 script that serves as a registrar and bootstrap channel, profiling the host, polling a registration endpoint, and maintaining a durable instanceId .
Microsoft advises organizations to treat developer workflows as a primary attack surface and secure boundaries around untrusted repositories. Enabling Visual Studio Code Workspace Trust and Restricted Mode by default for unknown projects, reviewing automation files before granting trust, and implementing attack surface reduction rules in Defender for Endpoint are recommended.
For detection and hunting, utilizing Advanced Hunting tables like DeviceNetworkEvents and DeviceProcessEvents to monitor suspicious Node.js activities is advised. Organizations can operationalize these behaviors into hunting queries and analytics rules within Microsoft Sentinel to detect future threats.
Based on reporting by GBHackers.