Fake job interviews target developers with new Python backdoor

Dev Popper is a multi-stage social-engineering campaign targeting software developers with fake job interviews that prompt victims to download an NPM package which ultimately deploys an obfuscated Python RAT; the malware enables persistent remote access, filesystem search and exfiltration (including FTP), remote execution, and keystroke/clipboard logging. Researchers observed the delivery chain (malicious NPM package -> Node.js curl stage -> downloaded Python payload) and note tactics consistent with North Korean groups, although attribution remains inconclusive.