Threats · 188 days ago

Fake Developer Interviews Deliver Backdoors and Steal Credentials

Threat actors used fake developer hiring to push malicious NPM packages that install backdoors (OtterCookie, FlexibleFerret). The campaign targets developers at technology and media firms and steals API tokens, cloud credentials, crypto wallets, and source code. Block unvetted package installs

Timeline

• Mar 11 Reported by Microsoft Security Blog

Sources

1 source covering this story

• Microsoft Security Blog Mar 11

  Contagious Interview: Malware delivered through fake developer job interviews | Microsoft Security Blog

  Threat actors pose as recruiters from crypto and AI companies and deliver backdoors such as OtterCookie and FlexibleFerret through fake coding assessments.

Part of the PlainSec briefing for 2026-03-15

Editions

• Briefing for 2026-03-12

Related stories

• Iran-Aligned Actors Escalate Cyber Attacks on US, Allies
• GlassWorm Uses Open VSX Extensions to Target Developers
• AppsFlyer Web SDK Temporarily Delivered Crypto‑stealing JavaScript