Malicious Next.js Repos Target Developers Via Fake Job Interviews

Microsoft researchers uncovered a developer‑targeting campaign that weaponizes malicious Next.js repositories and fake recruitment/interview materials to achieve remote code execution and establish persistent C2 on compromised developer hosts; attackers abused VS Code workspace automation and obfuscated assets to fetch and execute attacker-controlled JavaScript, risking exposure of source code, secrets, build and cloud access and enabling supply‑chain compromise.