Iran-aligned DarkBlinders used convincing recruitment offers while posing as Dubai Airports recruiters to target a high-value job seeker in Iraq. The victim was asked to complete what appeared to be a coding assessment, but the assessment package installed malware. The group also used lookalike government, webmail, cloud-storage, and videoconferencing sites to steal credentials or distribute malicious software.
A group referred to as DarkBlinders approached a high-value job seeker in Iraq while posing as recruiters for Dubai Airports. The pretext involved a lucrative job offer and a request to complete what looked like a standard coding assessment. The assessment itself initially appeared harmless, a tactic meant to build credibility with the target before the real payload arrived. That payload came in the form of a Microsoft Visual Studio project archive, which deployed ShelbyLoader and the SHELBYC2 backdoor once opened.
The lure worked because it mirrored a legitimate hiring process that software developers and IT professionals regularly encounter. Coding assessments, project files, and development tools are routine parts of a job application, which made the malicious archive far less likely to raise suspicion than a typical phishing email with a link. The attackers also layered in credibility by impersonating a well-known aviation brand and framing the initial file as a harmless decoy before escalating to the actual malware stage.
Beyond the recruiting lure, the same group registered multiple lookalike domains for a fake videoconferencing service called StarkMeet, including stark-meet[.]com, stark-meet[.]online, and stark-meet[.]website. Users who downloaded and launched the counterfeit application triggered the same ShelbyLoader and SHELBYC2 malware chain. The group also maintained lookalike government, webmail, and cloud-service domains to harvest credentials or serve malicious downloads, showing a pattern of combining credential phishing with direct malware delivery across multiple pretexts.
Treat any unexpected recruiting contact that requires downloading or running code as suspicious, and verify the recruiter and employer independently using contact details from the real organization rather than information in the message. Avoid executing developer files, project archives, or assessment packages from unverified sources, and install meeting or collaboration software only from approved internal sources or confirmed vendor sites. These habits reduce exposure to lures that mix a credible pretext with a technical delivery mechanism designed to bypass routine suspicion.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers posed as Dubai Airports recruiters and offered a high-value job seeker a lucrative role, asking them to complete a coding assessment delivered as a Microsoft Visual Studio project archive that actually deployed malware.
The trojanized coding assessment ultimately deployed ShelbyLoader and the SHELBYC2 backdoor on the victim's device.
The group also set up lookalike government, webmail, and cloud-service domains for credential theft, and a fake StarkMeet videoconferencing app that installed malware when launched.
Independently verify any recruiter and employer through official channels before running coding tests, and avoid executing project archives or developer files sent as part of an unsolicited job offer.
A Dubai Airports recruiter offers you a great job. Then comes the coding test. The email asks you to open a Microsoft Visual Studio project archive. First, a career-portal questionnaire builds trust. Then the coding assessment runs ShelbyLoader and the SHELBYC2 backdoor. Here's the tell: a recruiter wants you to run code on your work device, not use a hiring platform. The same campaign pushed fake StarkMeet downloads from stark-meet dot com. Before opening any job-test package, contact the employer through its official website and verify the recruiter.
Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers linked an Iran-aligned campaign to recruitment-themed social engineering that tricked a targeted Iraqi software engineer into downloading a fake "Dubai Airports" careers portal and then opening a trojanized Visual Studio coding test. The lure abused normal developer workflows so malware…
Attackers sent personalized fake federal court notices to more than 100,000 companies, impersonating the US District Court for the Southern District of Florida. The emails directed recipients to a counterfeit court website and offered a password-protected case file that ultimately installed…
Researchers reported two China-aligned campaigns that used phishing and impersonation to target AI policy experts and multiple Asian government organizations. One campaign built rapport with “AI policy” themed outreach before sending links to a OneDrive credential-harvesting page, while another…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
