{"id":218573,"date":"2026-02-26T05:35:00","date_gmt":"2026-02-26T10:35:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/02\/26\/microsoft-warns-developers-of-fake-next-js-job-repos-delivering-in-memory-malware\/"},"modified":"2026-02-28T23:25:09","modified_gmt":"2026-03-01T04:25:09","slug":"microsoft-warns-developers-of-fake-next-js-job-repos-delivering-in-memory-malware","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/02\/26\/microsoft-warns-developers-of-fake-next-js-job-repos-delivering-in-memory-malware\/","title":{"rendered":"Microsoft Warns Developers of Fake Next.js Job Repos Delivering In-Memory Malware"},"content":{"rendered":"

Microsoft Warns Developers of Fake Next.js Job Repos Delivering In-Memory Malware<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/02\/fake-nextjs-repos-target-developers.html<\/a><\/p>\n

Publish Date: 2026-02-26 05:35:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

A “coordinated developer-targeting campaign” is using malicious repositories disguised as legitimate Next.js projects and technical assessments to trick victims into executing them and establish persistent access to compromised machines.<\/p>\n

“The activity aligns with a broader cluster of threats that use job-themed lures to blend into routine developer workflows and increase the likelihood of code execution,” the Microsoft Defender Security Research Team said in a report published this week.<\/p>\n

The tech giant said the campaign is characterized by the use of multiple entry points that lead to the same outcome, where attacker-controlled JavaScript is retrieved at runtime and executed to facilitate command-and-control (C2).<\/p>\n

The attacks rely on the threat actors setting up fake repositories on trusted developer platforms like Bitbucket, using names like “Cryptan-Platform-MVP1” to trick developers looking for jobs into running them as part of an assessment process.<\/p>\n

Further analysis of the identified repositories has uncovered three distinct execution paths that, while triggered in different ways, have the end goal of executing an attacker\u2011controlled JavaScript directly in memory –<\/p>\n