Lazarus Hackers Abuse Git Symlink Vulnerability in Stealthy Phishing Campaign

Lazarus Hackers have been linked to a stealthy phishing campaign that exploits a recently disclosed Git symlink vulnerability, CVE-2025-48384, to target cryptocurrency and financial institutions worldwide. According to KuCoin’s security team, the operation blends mass phishing with precision attacks, using LinkedIn and X (Twitter) to lure victims with counterfeit interview invites and fake job postings.

The campaign’s technical core involves cloning a malicious repository during Git operations, where a symlink in api/db_drivers points to internal modules and executes a planted post-checkout hook that triggers a Node.js backdoor (mongodb.hook.js) to establish persistence. Victims on macOS download a downloader and Go-based stealer via a LaunchAgent, while Windows victims run a PowerShell/CMD sequence to extract malicious components and register startup persistence.

The Lazarus Group’s activities are described as multi-vector, including tainted Git and npm packages and supply-chain intrusions, with targets ranging from security researchers to high-value cryptocurrency and financial sector victims.