A North Korea-linked campaign used fake job interview projects to target developers, including a DevOps engineer at an Indian IT services company with no cryptocurrency ties. Running a booby-trapped Terraform project could expose cloud credentials, source code access and other data available from the developer’s Mac.
The finding shows why infrastructure and DevOps workers are attractive targets even outside cryptocurrency companies: attackers may value whatever systems their laptops can reach.
ROOFDECK provides wider remote control, including file searches, downloads, uploads, interactive shells and clipboard access. Clipboard access matters because copied passwords, two-factor codes and wallet seed phrases may be exposed.
A broader pool of targets
SentinelLabs found the same FLATROOF and ROOFDECK macOS backdoors previously seen in the LayerZero attack on one Apple Silicon MacBook at the Indian provider. The machine belonged to a DevOps engineer and held cloud credentials and source-control access.The finding shows why infrastructure and DevOps workers are attractive targets even outside cryptocurrency companies: attackers may value whatever systems their laptops can reach.
Terraform lock file triggers the trap
The malicious GitHub projects pose as coding assignments from prospective employers. Their .terraform.lock.hcl files point Terraform to attacker-controlled provider registries, so terraform init downloads and runs malicious provider modules.- Treat unexpected repositories named terraform-candidate-repo, Northwind-IAC or novacart-interview as suspicious.
- Look for provider domains including registry.hashicorp-aws.com, registry.hashicorp-aws.io and registry.hashicorp-terraform.io; these are not the normal HashiCorp registry domain.
- If a project was already run, disconnect the Mac from sensitive company systems and ask the security team to check for ~/Library/com.apple.iTunesCloud/SystemUpdate and ~/Library/com.apple.internal.ck/iSync.
What the backdoors can access
FLATROOF can collect browser data, terminal histories, application and process lists, system details and a copy of the macOS login keychain database. It can also run shell commands and send files through Telegram.ROOFDECK provides wider remote control, including file searches, downloads, uploads, interactive shells and clipboard access. Clipboard access matters because copied passwords, two-factor codes and wallet seed phrases may be exposed.
Reduce the risk before running code
- Open interview projects as text first, and inspect Terraform lock and configuration files without initializing the project.
- Confirm the employer and interviewer through an independently found company contact before running their code.
- Use a disposable, isolated test environment without work cloud credentials, source-control tokens or access to production systems.
