Lazarus Group Hides Malware in Git Hooks Used in Fake Coding Assessments
Summary
OpenSourceMalware reports that Lazarus-linked fake coding-assessment repositories use Git hooks to fetch OS-specific payloads, potentially leading to credential and crypto-wallet theft. It shares infrastructure and a GitHub hunt query.
Key points
- The report attributes the activity to the DPRK Lazarus Group’s Contagious Interview/TaskJacker campaign.
- Fake coding-assessment repositories reportedly use pre-commit hooks as loaders; the article also notes use of post-checkout hooks.
- The loader fingerprints the operating system, then downloads a platform-specific script from precommit[.]vercel.app and runs it through a shell or cmd.exe.
- The article says the campaign’s multi-stage loader delivers InvisibleFerret-style implants associated with credential and crypto-wallet theft.
- The same pre-commit hook content, with reported Git blob SHA 3ebd9bb57d155cc7c3353660f54c153a094cdfbd, was found across several repositories matching the described lure pattern.
- The report provides a GitHub code-search query to hunt for hooks referencing vercel.app.
- For interview repositories, the article recommends inspecting Git hook and setup files and using a disposable VM without access to SSH credentials or wallets.
Article Details
- Attack Vectors
- Fake recruiters use crypto-, DeFi-, or web3-themed coding-assessment repositories to persuade candidates to clone and run code locally.
- A malicious .githooks/pre-commit script fingerprints the operating system with uname -s, downloads a platform-specific payload, and pipes it to sh or cmd.exe. The article also reports use of post-checkout hooks, which trigger when users change branches.
- The loader runs silently and exits successfully so the commit appears to work normally.
- Defensive Notes
- Treat interview-assessment repositories as hostile until verified; inspect .githooks/, .husky/, .vscode/tasks.json, and postinstall scripts before running code.
- Run untrusted assessment code in a disposable VM without browser profiles, SSH credentials, or mounted cryptocurrency wallets.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | precommit[.]vercel[.]app | Reported attacker-used payload server serving platform-specific scripts. |
| URL | hxxps[:]//precommit[.]vercel[.]app/settings/linux?flag=5 | Article-identified C2 URL serving the Linux payload. |
| URL | hxxps[:]//precommit[.]vercel[.]app/settings/mac?flag=5 | Article-identified C2 URL serving the macOS payload. |
| URL | hxxps[:]//precommit[.]vercel[.]app/settings/windows?flag=5 | Article-identified C2 URL serving the Windows payload. |
MITRE ATT&CK
T1036 · MasqueradingThe attacker-used hostname is described as resembling the official pre-commit framework's marketing site.T1059.003 · Windows Command ShellOn Windows Git Bash, MSYS, or Cygwin environments, the hook pipes the downloaded payload into cmd.exe.T1059.004 · Unix ShellOn macOS and Linux, the hook pipes the downloaded payload into sh.T1105 · Ingress Tool TransferThe hook downloads a per-platform payload from the reported server using curl or wget.T1204.002 · Malicious FileFake coding-assessment repositories persuade candidates to execute code locally.
Threat Actors
Malware
Countries
Industries
DeFiwas committed to several GitHub repositories that follow the standard Contagious Interview lure pattern: defi/crypto-token themed projects, freshly-created accounts, minimal commit history, and a "task" that requiresWeb3being asked to clone a repo as part of an interview process — especially one in the crypto, DeFi, or web3 space — assume it's hostile until proven otherwise. Inspect .githooks/, .husky/, .vscode/tasks.json, and