Excerpt
The OpenSourceMalware team has spotted a fresh twist in the DPRK's Contagious Interview / TaskJacker playbook: the operators have pivoted away from stuffing their stage-2 loader into .vscode/tasks.json , package.json postinstall scripts, or fake .woff2 font files, and are now hiding it inside Git hooks. The candidate clones the "coding assessment" repo, and the loader fires before the commit object is even written. What the hook actually does
The malicious .githooks/pre-commit script is short, which is the whole point — it's a thin loader that fingerprints the OS via uname -s , then curls or wgets a per-platform payload from precommit.vercel.app and pipe…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by opensourcemalware.com on opensourcemalware.com.
Mentioned in the excerpt
More from opensourcemalware.com4
- GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font Fileopensourcemalware.com · Published 16 Oct
- WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentialsopensourcemalware.com · Published 17 Sep
- ChainVeil and ViteVenom are DPRK’s PolinRider Campaignopensourcemalware.com · Published 17 Jul
- PolinRider Confirmed Footprint Grows 6.5x Since Marchopensourcemalware.com · Published 15 Jul
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
