North Korean Hackers Use New Techniques in Developer Attacks

North Korean hacker group Lazarus has adopted new methods in their malicious activities targeting developers, according to ChainCatcher. Research by OpenSourceMalware reveals that the group is hiding second-stage loaders in Git Hooks' pre-commit scripts during operations like 'Infectious Interview' and 'TaskJacker.' These attacks involve impersonating recruitment processes in the cryptocurrency and DeFi sectors to trick developers into cloning malicious code repositories, ultimately stealing crypto assets and credentials. Researchers advise developers who are asked to clone code repositories as part of an interview process to be cautious of such risks. It is recommended to run these processes in isolated environments to avoid exposing personal browser configurations, SSH keys, and crypto wallets.