This article discusses a cybersecurity scam targeting entry-level front-end developers through fake job offers on LinkedIn. Recruiters lure victims with enticing job opportunities, sharing malicious code repositories that compromise systems. One example involves an obfuscated JavaScript file designed to steal sensitive information and deploy further malware, attributed potentially to the Lazarus group. Affected: job seekers, entry-level front-end developers, tech industry.
Keypoints :
- Scammers target entry-level front-end developers on LinkedIn with fake job offers.
- Victims receive links to code repositories containing malicious files.
- An example involved a suspicious JavaScript file aimed to exfiltrate sensitive data.
- The malware execution process includes information stealing and a Python-based remote access payload.
- Tools used in the attack are associated with the Lazarus group, a known cybercriminal organization.
- Job seekers are advised to verify recruiter legitimacy, scrutinize code repositories, and remain vigilant against unrealistic job offers.
MITRE Techniques :
- Credential Dumping (T1003): The obfuscated JavaScript file steals login credentials stored in web browsers.
- Data Encrypted for Impact (T1486): The second stage includes deploying a Python-based Remote Access Trojan (RAT) for sensitive file exfiltration.
- Exploitation for Client Execution (T1203): Malicious code was executed when victims cloned the repository and ran local servers.
- Command and Control (T1071): The Python loader executed RAT commands to extract sensitive system information.
- Resource Hijacking (T1496): The deployed XMRig cryptominer exploited the victim’s computing resources for cryptocurrency mining.
Indicator of Compromise :
- [File] onfig-overrides.js
- [File] malicious code (exact content not provided)