Threats · 233 days ago

Fake developer interviews deliver backdoors, steal credentials

Microsoft observed a campaign using fake developer interviews to deliver backdoors via malicious NPM packages. Backdoors OtterCookie and FlexibleFerret exfiltrate API tokens, cloud credentials, crypto wallets, and source code from developers at technology and media firms.

Timeline

• Mar 11 Reported by Microsoft Security Blog

Sources

1 source covering this story

• Microsoft Security Blog Mar 11

  Contagious Interview: Malware delivered through fake developer job interviews | Microsoft Security Blog

  Threat actors pose as recruiters from crypto and AI companies and deliver backdoors such as OtterCookie and FlexibleFerret through fake coding assessments.

Part of the PlainSec briefing for 2026-03-12

Editions

• Briefing for 2026-03-12

Related stories

• Iran-linked hackers cripple Stryker's global Microsoft environment
• Iran-aligned actors escalate cyber attacks on US, allies
• Over 250 WordPress sites serve ClickFix CAPTCHA infostealers