Microsoft observed a campaign using fake developer interviews to deliver backdoors via malicious NPM packages. Backdoors OtterCookie and FlexibleFerret exfiltrate API tokens, cloud credentials, crypto wallets, and source code from developers at technology and media firms.
Contagious Interview: Malware delivered through fake developer job interviews | Microsoft Security Blog
Threat actors pose as recruiters from crypto and AI companies and deliver backdoors such as OtterCookie and FlexibleFerret through fake coding assessments.