Adversary Intelligence — 2026-05-12

North Korean Hackers Weaponize Git Hooks to Deploy Cross-Platform Malware

OpenSourceMalware researchers on May 6 documented a new Lazarus Group delivery method in the Contagious Interview campaign: malicious pre-commit scripts embedded in GitHub repositories sent to developers as fake job assessments by actors posing as LinkedIn recruiters. The pre-commit hook, placed in the repository's `.githooks/` directory, fingerprints the victim's OS on execution and silently fetches a platform-specific payload from `precommit[.]vercel.app`, a Vercel-hosted domain. All hook output is suppressed and the hook exits with a success code, so commits complete without visible error. Cyber Security News and GBHackers, publishing May 12, corroborate the technique and note that observed intrusions also deployed post-checkout hooks and delivered BeaverTail and InvisibleFerret implants.

Analysis
Assessed from single-source OpenSourceMalware research with no independent corroboration, the pivot from npm postinstall scripts to git hooks signals Lazarus's active monitoring of defensive improvements. Suppressed output and a forced success exit code turn normal commit workflow into a detection blind spot; post-checkout hooks extend that surface into branch operations, enabling repeated re-infection. BeaverTail and InvisibleFerret fit documented Lazarus lineage; Vercel infrastructure continues the group's pattern of leveraging legitimate cloud platforms to resist blocklisting. The campaign's crypto and DeFi focus suggests revenue generation as the primary driver, narrowing the immediate threat to individual developers rather than enterprise networks broadly. Lazarus is likely to be publicly attributed to at least one additional supply chain compromise within six months; timing remains unpredictable.

2 sources

North Korean Hackers Weaponize Git Hooks to Deploy Cross-Platform Malware - Cyber Security News
North Korea Hackers Abuse Git Hooks to Deploy Cross-Platform Malware - GBHackers