STEALINT

NK hackers are targeting software developers and job applicants with fake coding interview tasks. They send you a GitHub repository link and ask you to git clone it to complete a programming test. Inside the repo, they hide a malicious Git Hook (a small script that Git runs automatically). The hook is placed at .githooks/pre-commit (not in the usual .git/hooks folder). As soon as you run git commit (a completely normal thing every developer does), the hook triggers automatically. The script quickly checks your operating system (Mac, Linux, or Windows), then silently downloads and runs the real malware from precommit[.]vercel[.]app. The downloaded malware belongs to Lazarus’s toolkit InvisibleFerret and Beavertail backdoors.