Beware of Fake Job Interview Challenges Attacking Developers To Deliver Malware

A North Korea-aligned cybercriminal campaign dubbed DeceptiveDevelopment has been targeting freelance software developers through fake job interviews since early 2024. Posing as recruiters on platforms like LinkedIn, Upwork, and cryptocurrency-focused job boards, attackers lure victims with promising job opportunities or lucrative freelance projects. The ultimate goal is to trick developers into executing trojanized codebases that […] The post Beware of Fake Job Interview Challenges Attacking Developers To Deliver Malware appeared first on Cyber Security News.

Feb 27, 2025 - 13:36

Beware of Fake Job Interview Challenges Attacking Developers To Deliver Malware

A North Korea-aligned cybercriminal campaign dubbed DeceptiveDevelopment has been targeting freelance software developers through fake job interviews since early 2024.

Posing as recruiters on platforms like LinkedIn, Upwork, and cryptocurrency-focused job boards, attackers lure victims with promising job opportunities or lucrative freelance projects.

The ultimate goal is to trick developers into executing trojanized codebases that deploy malware designed to steal cryptocurrency wallet data, browser credentials, and sensitive system information.

Researchers identified two primary malware families in this campaign: BeaverTail, an infostealer and downloader, and InvisibleFerret, a modular backdoor enabling remote access and data exfiltration.

These tools are remain hidden within software projects that victims are asked to review or modify as part of a fake hiring challenge.

Notably, the attackers exploit GitHub’s interface by appending malicious code after long comments, pushing it off-screen in the default editor view.

Malicious code appended after a long comment pushing it off-screen in GitHub’s code editor (top) and the page source of just line #1 (Source – ESET)

ESET researchers noted that this obfuscation technique increases the likelihood of victims unknowingly executing the malware.

Technical Delivery: Hidden Code and Obfuscation

The attackers’ reliance on social engineering is complemented by sophisticated technical tactics.

BeaverTail, delivered as JavaScript or Qt-based executables, begins by decrypting hardcoded Command-and-Control (C&C) server details.

For example, the IP address 147.124.214.237:1244 is split into base64-encoded fragments and rearranged to evade detection:-

javascript host="yNDEuMjA4MTg1LjIzNS4" // Decoded to 147.124.214.237 via string manipulation

DeceptiveDevelopment compromise chain (Source – ESET)

Once executed, BeaverTail searches for browser extensions like MetaMask, Coinbase Wallet, and Phantom to exfiltrate cryptocurrency keys stored in id.json (Solana) or browser databases.

It also harvests login credentials from Firefox, Chrome, and system keychains. InvisibleFerret, the second-stage payload, uses XOR encryption and modular Python scripts to maintain persistence.

One sample decrypts its payload using a hardcoded key (G01d*8@() and establishes a reverse shell for remote command execution.

Browser credential decryption logic in InvisibleFerret (Source – ESET)

The malware’s browser module targets Chrome, Brave, and Edge profiles to extract encrypted credentials, leveraging OS-specific decryption methods—such as win32crypt on Windows or secretstorage on Linux—to decode sensitive data.

The campaign’s infrastructure relies on servers hosted by providers like RouterHosting and Majestic Hosting Solutions.

C&C communication occurs over non-standard ports (1244, 3000) to blend with legitimate traffic. Recent updates to InvisibleFerret include FTP-based data exfiltration and integration with Telegram’s API for real-time credential theft, signaling evolving operational sophistication.

Developers are advised to verify recruiter identities, avoid executing unsolicited projects, and monitor for anomalous network activity on ports 1224–1245.

Collect Threat Intelligence on the Latest Malware and Phishing Attacks with ANY.RUN TI Lookup -> Try for free

The post Beware of Fake Job Interview Challenges Attacking Developers To Deliver Malware appeared first on Cyber Security News.