Lazarus Group Using Git Hooks to Hide Malware – Open-Source Malware Blog
17 hours ago
- Lazarus Group's Contagious Interview and TaskJacker campaigns now hide stage-2 loader in Git hooks instead of .vscode/tasks.json or package.json.
- The malicious pre-commit hook executes automatically when a victim clones a fake coding assessment repo and attempts to commit, downloading a per-platform payload from precommit.vercel.app.
- The hooks use OS fingerprinting (uname -s) to serve different payloads for macOS, Linux, and Windows, and always exit 0 to avoid suspicion.
- The hostname 'precommit.vercel.app' mimics the legitimate pre-commit framework, but is a free Vercel deployment for payload delivery.
- Operators also use post-checkout hooks that fire when switching branches, making the attack even more stealthy.
- Developers are advised to inspect .githooks/, .husky/, .vscode/tasks.json, and postinstall scripts before running any code, preferably in a disposable VM.
- Indicators of compromise include the C2 domain precommit.vercel.app and specific loader SHA-256 hashes, with GitHub search queries provided for threat hunting.