Research: North Korean Hacker Group Lazarus Uses Git Hooks to Hide Malware

Mars Finance reports that according to OpenSourceMalware research, the North Korean hacker group Lazarus has adopted new techniques in malicious activities targeting developers, such as “Infectious Interview” and “TaskJacker,” by hiding the second-stage loader within Git Hooks’ pre-commit scripts. “Infectious Interview” is a series of attacks where the group impersonates recruitment processes in the cryptocurrency/DeFi space to lure developers into cloning malicious code repositories, ultimately stealing crypto assets and credentials. Researchers advise that developers asked to clone code repositories as part of interview procedures should be cautious of such risks, preferably running in isolated environments, and avoid mounting personal browser configurations, SSH keys, and crypto wallets.