Bogus npm Packages Used to Trick Software Developers into Installing Malware

An ongoing social engineering marketing campaign is concentrating on software builders with bogus npm packages underneath the guise of a job job interview to trick them into downloading a Python backdoor.

Cybersecurity business Securonix is monitoring the action below the name DEV#POPPER, linking it to North Korean threat actors.

“Through these fraudulent interviews, the builders are often questioned to perform jobs that include downloading and working program from resources that look reputable, this kind of as GitHub,” security scientists Den Iuzvyk, Tim Peck, and Oleg Kolesnikov stated. “The software contained a malicious Node JS payload that, when executed, compromised the developer’s method.”

Specifics of the campaign first emerged in late November 2023, when Palo Alto Networks Device 42 thorough an action cluster dubbed Contagious Interview in which the risk actors pose as companies to lure application developers into installing malware these as BeaverTail and InvisibleFerret as a result of the interview method.

Then earlier this February, software program source chain security organization Phylum uncovered a established of malicious packages on the npm registry that delivered the very same malware family members to siphon sensitive data from compromised developer devices.

It can be well worth noting that Contagious Interview is claimed to be disparate from Procedure Aspiration Job (aka DeathNote or NukeSped), with Device 42 telling The Hacker News that the former is “targeted on concentrating on developers, primarily as a result of bogus identities in freelance task portals, and the following levels include the use of developer resources and npm packages primary to […] BeaverTail and InvisibleFerret.”

Procedure Dream Work, connected to the prolific Lazarus Team from North Korea, is a prolonged-operating offensive marketing campaign that sends unsuspecting professionals utilized in various sectors like aerospace, cryptocurrency, protection, and other sectors malicious data files dressed as task gives to distribute malware.

Very first uncovered by Israeli cybersecurity company ClearSky at the start out of 2020, it also displays overlaps with two other Lazarus clusters regarded as Operation In(ter)ception and Operation North Star.

The attack chain specific by Securonix commences with a ZIP archive hosted on GitHub that is probably sent to the concentrate on as section of the job interview. Existing inside the file is a seemingly innocuous npm module that harbors a destructive JavaScript file codenamed BeaverTail that functions as an info stealer and a loader for a Python backdoor identified as InvisibleFerret that is retrieved from a remote server.

The implant, other than collecting process information and facts, is able of command execution, file enumeration and exfiltration, and clipboard and keystroke logging.

The advancement is a sign that North Korean menace actors keep on to hone a raft of weapons for their cyber attack arsenal, constantly updating their tradecraft with improved talents to cover their steps and mix in on host methods and networks, not to point out siphon off information and turn compromises into monetary obtain.

“When it comes to attacks which originate through social engineering, it is really critical to preserve a security-targeted state of mind, specially throughout intense and demanding situations like position interviews,” Securonix scientists mentioned.

“The attackers behind the DEV#POPPER campaigns abuse this, recognizing that the human being on the other finish is in a hugely distracted and in a substantially extra vulnerable condition.”

Identified this report exciting? Comply with us on Twitter  and LinkedIn to go through a lot more distinctive material we submit.

Some components of this report are sourced from:
thehackernews.com