Researchers reported a real developer-targeting campaign linked to DPRK actors where attackers pose as legitimate recruiters or Web3 companies and trick targets into running code or pulling poisoned dependencies. The operation has now expanded to include malicious Terraform providers hosted in the HashiCorp Terraform Registry, alongside malicious packages in common developer ecosystems.
This campaign centers on a recurring playbook aimed at software developers, DevOps engineers, and open source maintainers. Attackers pose as recruiters or as non-existent Web3 companies on platforms like LinkedIn and Facebook, or through job postings on forums, and approach developers with promising opportunities. Once a rapport is established, the target is asked to complete a coding task that requires cloning a GitHub repository or pulling in a dependency published on npm or PyPI. That dependency introduces the malicious behavior.
A related vector uses video calls set up for what looks like a job interview, a project discussion, or a contract opportunity. During the call, the target is asked to install something described as a missing audio codec, or to execute a command, sometimes pasted directly via clipboard. The attackers reportedly set up new but legitimate-seeming company profiles, including plausible LinkedIn presences, that pass only cursory inspection.
Most notably, the operation has expanded to abuse the official HashiCorp Terraform Registry, hosting malicious Terraform providers there as a supply-chain distribution channel. Because Terraform providers often have access to cloud credentials and infrastructure configuration, this route can offer a more direct pathway to production environments than a typical package dependency.
The campaign leans on trust signals developers rarely question: a recruiter message, a coding assignment, or a video call invite. Fake company profiles are built to withstand a quick look, and the payloads are engineered to activate only under specific conditions, such as during a particular cryptographic operation, which helps them evade casual review and generic sandboxing. Command-and-control activity reportedly used blockchain based dead drops and Slack API access, blending malicious traffic into channels developers already use.
Treat any unsolicited request to install software or run code during a hiring or contracting process as high risk until the company and recruiter are verified through an independent channel. Never install “missing codecs” or execute commands provided during an interview call without pausing to confirm legitimacy. Enable multi-factor authentication on developer and package registry accounts, and periodically review accounts for unexpected logins. Finally, apply the same scrutiny to infrastructure tooling, including Terraform providers, that teams already apply to application dependencies, since these tools can offer a direct path to production credentials.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Researchers found malicious Terraform providers hosted in the official HashiCorp Terraform Registry, used as a supply-chain distribution channel alongside poisoned packages in npm and PyPI.
Attackers pose as recruiters or fake Web3 companies on platforms like LinkedIn and Facebook, then ask developers to complete a coding task that pulls in a malicious dependency.
Yes, a related tactic sets up a job or project video call and asks the target to install a purportedly missing audio codec or run a command, often pasted via clipboard.
Enable MFA, review accounts for unexpected logins, verify recruiters and companies independently, and treat any request to run code or install software during an interview as high risk.
You get a LinkedIn DM from a slick Web3 “recruiter” with a great salary and a quick coding task. Nice, right? Here’s the play: they send you a GitHub repo and insist you use their npm, PyPI package or even a Terraform provider they published to the official Terraform Registry. You run the code, and their Graphalgo-style malware rides in with your build. Sometimes they even jump on a video call and say, “You’re missing an audio codec, just run this command.” The company looks legit at a glance, but that one copy‑paste can drop Go-based malware that only wakes up when your code hits specific crypto operations. If any recruiter or interviewer asks you to run their code, install a codec, or add their Terraform provider, stop and verify the company and person through a trusted channel before you touch your terminal.
A real phishing campaign is targeting DEF CON speakers and attendees through X/Twitter messages pretending to be a Coindesk executive. Victims are sent to a Google document that attempts a “click-fix” trick to get them to paste malicious commands into a terminal or download malware. The goal is to…
After Black Hat/DEF CON, cybercriminals allegedly targeted conference attendees by impersonating a CoinDesk executive over X direct messages. Victims were pushed into a realistic workflow using Google Docs and a fake Dropbox DocSend installer to trick them into running malware on macOS or Windows.
The Rust Project warned that attackers are approaching Rust contributors and crate maintainers with believable recruiter outreach and “company” profiles, then using interview video calls to trick targets into installing malware or running commands. The activity is described as similar to North…
This weekly threat bulletin includes real-world campaigns where attackers impersonate recruiters and use fake hiring steps to trick people into running malicious files. One campaign uses fake LinkedIn coding tests delivered via cloud links, and another uses fake job interviews with trojanized macOS…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
