Opening the Coding Test Was the Execution Step
Unit 42’s Blinder Tunnel report traces an Iranian-nexus operation targeting one person in Iraqi critical infrastructure. Infrastructure staging began in November 2025, recruitment in March 2026 and a fake Dubai Airports coding challenge in April. Unit 42 reported no known Dubai Airports compromise.
A malicious .csproj abused Visual Studio design-time evaluation, so loading the project could trigger AppDomainManager hijacking and DLL sideloading before an explicit build or run.
Treat project files as executable input
Editorially, isolate unsolicited projects and inspect .csproj targets before loading. Hunt with Unit 42’s indicators despite GitHub’s takedown. The Iranian nexus is high confidence; named-group overlaps and separate Israel phishing remain distinct.
