Fake Dubai Airports Recruiters Target Developers

How the attack worked

The campaign began as a recruitment lure. Attackers impersonating the Dubai Airports IT department approached a targeted software engineer in Iraq with a job offer for a development role. As a mandatory first step, the target was told to download and install a file named Dubai Airport Careers, which deployed an offline site posing as a careers portal. To access the supposed assessment, the target had to log in using credentials supplied by the fake recruiters, which made the experience feel like a genuine hiring process.

The second stage escalated the attack. The threat actor sent a weaponized Microsoft Visual Studio project archive disguised as a coding assessment, framed as a Flight Management System bug-fix task from a supposed senior manager. The infection began the moment the target opened the project in their development environment, even before any attempt to compile the code, abusing background checks performed by the development tool itself.

Why it succeeded

This attack worked because it exploited normal developer and hiring workflows rather than obvious technical flaws:

• The pretext (a real-sounding job offer) made the target willing to install software and enter credentials without suspicion.
• The use of a coding assessment as a delivery mechanism fit naturally into expected recruitment steps for engineering roles.
• Execution occurred silently through legitimate developer tooling, with no need to trick the victim into running an obviously suspicious file.
• Command-and-control traffic was disguised inside GitHub APIs, issues, and comments, making it blend in with ordinary cloud and developer activity.

What to watch for

• Unsolicited recruitment outreach that requires installing software or a portal before any formal interview process.
• Requests to log into a job portal using credentials provided by the recruiter rather than ones you create yourself.
• Coding assessments delivered as downloadable project archives instead of through established, trusted testing platforms.
• Unusual GitHub API, issue, or comment activity that does not match normal developer collaboration patterns.

How to build resistance

Organizations and individuals in engineering and hiring roles can reduce exposure by treating recruitment channels as a legitimate attack surface. Verify recruiters and companies through trusted, independent contact paths before downloading anything. Avoid installing standalone career portal applications or opening project archives sent directly by recruiters, and instead use isolated test environments with security review for any coding challenges. Because developer tools can trigger execution just by opening a project, project files should be treated as potentially executable content rather than static documents. Security teams should also monitor for abnormal patterns in platforms like GitHub, since attackers may hide command traffic inside what looks like ordinary cloud and developer activity.

How did the fake Dubai Airports recruiter attack work?

Attackers impersonated the Dubai Airports IT department with a fake job offer, asking the target to install a file called Dubai Airport Careers that loaded an offline fake careers portal requiring recruiter-supplied login credentials.

What made the malware run before the victim did anything obvious?

The infection began the moment the target opened a weaponized Visual Studio project archive disguised as a coding assessment, before any attempt to compile the code.

How did the attackers hide their command-and-control traffic?

They misused GitHub APIs, issues, and encrypted comments to rotate command-and-control servers, making the traffic look like legitimate enterprise platform activity.

Who should be most concerned about this type of attack?

Software developers and engineers are the primary targets, but IT, security operations, and HR/hiring teams should also be aware since the lure abuses the recruitment process itself.