Hackers Pose as Dubai Airports Recruiters to Infect Software Engineers With ShelbyLoader V2

**Blinder Tunnel (CL-STA-1178)**: An Iranian state-aligned actor impersonated Dubai Airports recruiters to deliver a multi-stage supply-chain-like infection that used a weaponized Visual Studio project and legitimate Microsoft developer tooling to deploy ShelbyLoader V2, abuse AppDomainManager hijacking and DLL sideloading, and operate GitHub-based command-and-control; activity targeted Iraqi critical infrastructure in March–June 2026 and includes published IOCs and detection guidance.