Research: North Korean hacker group Lazarus uses Git Hooks to conceal malware

According to ChainCatcher, based on research by OpenSourceMalware, the North Korean hacker group Lazarus has adopted new methods in malicious activities targeting developers, such as "Infectious Interview" and "TaskJacker". Specifically, they are hiding secondary loaders in the pre-commit scripts of Git Hooks. “Infectious Interview” refers to a series of attacks where the group forges recruitment processes in the cryptocurrency/DeFi sector to lure developers into cloning malicious code repositories, ultimately stealing crypto assets and credentials.

Researchers advise developers who are asked to clone code repositories as part of an interview process to be wary of such risks. It is best to run these operations in an isolated environment to avoid exposing personal browser configurations, SSH keys, and crypto wallets.