Fake Job Interviews: A New Python Backdoor Threat Targeting Developers

In the ever-evolving world of cybersecurity, a new threat has emerged. A campaign, known as “Dev Popper,” is targeting software developers with fake job interviews. The goal? To trick them into installing a Python remote access trojan (RAT).

The Deception of Python Backdoor

The attackers initiate contact by posing as employers offering software developer positions. During the interview, the candidates are asked to download and run what is presented as a standard coding task from a GitHub repository. However, the threat actor’s goal is to make their targets download malicious software that gathers system information and enables remote access to the host.

The Multi-Stage Infection Chain

“Dev Popper” attacks involve a multi-stage infection chain based on social engineering. The process is designed to deceive targets through a process of progressive compromise. Once the developer runs the NPM package, an obfuscated JavaScript file hidden inside the backend directory is activated. This file executes ‘curl’ commands through the Node.js process to download an additional archive from an external server.

The Python Backdoor

Inside the archive is the next stage payload, an obfuscated Python script that functions as a RAT. Once the RAT is active on the victim’s system, it collects and sends basic system information to the command and control (C2) server. This includes OS type, hostname, and network data.

The RAT’s Capabilities

The RAT supports the following capabilities:

• Persistent connections for ongoing control.
• File system commands to search for and steal specific files or data.
• Remote command execution capabilities for additional exploits or malware deployment.
• Direct FTP data exfiltration from high-interest folders such as ‘Documents’ and ‘Downloads.’
• Clipboard and keystroke logging to monitor user activity and possibly capture credentials.

The Perpetrators

Although the perpetrators of the Dev Popper attack aren’t known, the tactic of using job lures as bait to infect people with malware is still prevalent. People should remain vigilant of the risks. The method exploits the developer’s professional engagement and trust in the job application process. Refusal to perform the interviewer’s actions could compromise the job opportunity, which makes it very effective.

In conclusion, the “Dev Popper” campaign is a showcase of the evolving threats in the cybersecurity landscape. Developers and other professionals must remain vigilant and skeptical of unsolicited job offers and tasks that require downloading and running code from unverified sources.

You think you have a story worth everyone’s time? SUBMIT A STORY and we will publish it.