Researchers reported an Iranian state-aligned actor impersonating the Dubai Airports IT department to lure a targeted Iraqi individual into installing a fake “careers portal” and then opening a weaponized coding test. The workflow looked like a real recruitment process (HR questions, then a developer assessment) but ultimately delivered malware when the victim opened a trojanized Visual Studio project.
The operation unfolded as a staged, multi-step recruitment process rather than a single malicious email. The target, described as an Iraqi individual, was approached with a job offer for a development role, with attackers impersonating the Dubai Airports IT department. As a mandatory first stage, the target was instructed to download and install a file named Dubai Airport Careers, effectively a fake careers portal used to establish initial access and build legitimacy.
Once the target progressed further, the attackers sent a coding assessment: a weaponized Microsoft Visual Studio project archive named DubaiAirport_Carrers_IT_Test.zip, with Carrers misspelled instead of Careers. The archive included a Readme.md with personalized instructions addressed directly to the target by name. The malicious code was embedded in a .csproj file, meaning it could execute as soon as the project loaded in an IDE, before the victim ever compiled or ran the code.
The early stages of the workflow, such as the careers portal and an HR-style questionnaire, did not trigger data exfiltration or malicious execution. This lack of suspicious activity appears to have been intentional, designed to build credibility and lower the victim's guard before the actual payload arrived in a later phase. By the time the weaponized project file showed up, the target had already engaged in what looked like a normal, multi-step hiring process.
The campaign also misused GitHub's API infrastructure for command-and-control communication, allowing malicious traffic to blend in with legitimate cloud and developer activity rather than standing out on a network.
Organizations can reduce exposure to this type of lure by training developers and engineers to treat unsolicited recruitment outreach that requires installing software or opening project files as high risk, and to verify such requests through official company channels first. Coding challenges and project files from unknown sources should go through a safe review process, such as an isolated environment, rather than being opened directly in a developer's primary IDE. Security teams should also watch for unusual GitHub API activity tied to downloads or key usage, since legitimate cloud services can be abused to mask command-and-control traffic within normal enterprise activity.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An actor impersonating the Dubai Airports IT department ran a staged recruitment workflow, first having the target install a fake careers portal, then sending a weaponized Visual Studio project disguised as a coding assessment.
The payload was delivered through a .csproj file inside a zip archive named DubaiAirport_Carrers_IT_Test.zip, which executed when the project loaded in an IDE, before the victim even compiled the code.
Early steps like the careers portal and questionnaire did not trigger any suspicious activity, which was designed to build credibility and lower the victim's guard before the malicious payload arrived later.
Yes, the campaign misused GitHub's API infrastructure for command-and-control communication to blend malicious traffic with normal cloud activity.
You get an email: “Dear , I’m from the Dubai Airports IT department with a developer role for you.” Sounds legit, right? They walk you through a fake careers portal, then send a “mandatory first stage” installer called Dubai Airport Careers. Next, a Visual Studio zip: DubaiAirport_Carrers_IT_Test.zip, a coding test that’s actually malware. Here’s the trick: the malicious .csproj runs as soon as you load it in Visual Studio. No build, no run button, just opening the project can hand over access, with traffic hiding inside normal GitHub API calls. If any “recruiter” asks you to install software or open a coding test ZIP, stop. Before you touch it, verify the job through the company’s official careers site or HR contact.
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
Two real, ongoing intrusion campaigns targeted organizations in Latin America, including a Mexican transportation organization and Brazil’s financial sector. In the Brazil campaign, attackers reportedly got in via a resume-themed phishing attachment, then attempted to download and run tunneling…
Researchers reported a real espionage campaign (“SilkParasite”) targeting Central Asian government bodies using spear‑phishing emails. The attack uses password‑protected RAR files containing malicious Microsoft Office documents; when opened, macros trigger a DLL sideloading chain to install remote…
A commonly used documentation placeholder domain, third-party.com, was registered by an unknown party and is now serving a ClickFix social-engineering lure to Windows users. The page pretends to run a Cloudflare security check, silently poisons the clipboard, and tells victims to paste and run a…
Attackers impersonated LastPass on GitHub and tricked people searching for the “LastPass Authenticator download” into installing a fake installer. The infection chain used a Microsoft-signed driver to disable many security tools, then deployed an infostealer that stole passwords, crypto wallets,…
