Lazarus Group Exploits Git Symlink Flaw in Advanced Phishing Campaign

Over the past year, the North Korea–linked Lazarus Group (also known as APT38) has escalated its efforts against cryptocurrency enterprises and security researchers by combining persuasive social engineering with robust cross-platform persistence tactics.

Attackers initiate contact through professional networking sites and messaging platforms, posing as recruiters offering software engineering opportunities.

These messages direct recipients to an imitation interview portal that mirrors legitimate corporate interfaces, complete with sequential evaluation steps and urgent prompts claiming missing system drivers.

Nontechnical staff are enticed to download what appears to be a simple camera driver fix, only to install a malicious launcher that embeds itself into the operating system’s persistence mechanisms.

On macOS systems, the installer silently unpacks a payload into a temporary directory before deploying a launch agent plist within the user’s Library/LaunchAgents folder. This configuration ensures automatic execution at each login without arousing suspicion.

Windows targets experience a similar chain, where an ostensibly harmless update script is registered in the current user’s startup registry key, initiating a renamed Python interpreter disguised as a legitimate system executable.

Through these covert steps, the malware harvests browser cookies, saved passwords, system metadata, and cryptocurrency wallet credentials before transmitting encrypted data to remote command-and-control servers.

The seamless integration of urgent social engineering tactics with native persistence features underscores Lazarus Group’s capacity to bypass conventional defenses and maintain long-term footholds within compromised environments.

Symlink-Based Supply Chain Intrusion via Git

In its most recent evolution, Lazarus Group has turned its attention to technical personnel by exploiting version-control systems commonly trusted by developers.

Victims are instructed to clone a purportedly innocuous software repository hosted on a popular GitLab instance, using a URL that contains embedded access credentials.

Within this repository, a directory named api/db_drivers appears to be a standard code submodule but is, in fact, a symbolic link to Git’s internal modules directory. This subtle manipulation enables the adversary to conceal a malicious post-checkout hook within the linked modules’ path.

When the victim performs the initial clone, Git’s default behavior triggers the hidden hook automatically, causing an in-memory Node.js script to decode and execute a Base64-encoded payload.

This payload establishes a covert backdoor channel to a command-and-control endpoint, granting the attackers remote access to the compromised system.

To eliminate signs of compromise, the hook then replaces the entire project tree with a benign release archive, effectively erasing forensic evidence of the intrusion.

By abusing trusted developer workflows and avoiding reliance on external scripts, this symlink-based approach defeats signature-based detection and exploits gaps in proactive Git hook validation.

The campaign’s precision targeting of developer toolchains reflects Lazarus Group’s deep understanding of software supply chain dynamics and its unwavering commitment to innovation.

The convergence of tailored social engineering and clandestine supply chain subterfuge demonstrates Lazarus Group’s adaptability and resource investments.

Security teams should treat unsolicited recruitment outreach with heightened suspicion, enforce strict validation of Git hooks and repository structures, and employ runtime monitoring to detect unauthorized hook execution.

Robust code review practices, coupled with continuous sharing of threat intelligence, are essential to disrupting this advanced phishing campaign before it inflicts significant financial and reputational damage.

 Indicators of Compromise (IOCs)

1. Malicious External Domains

https[:]//aptiscore[.]com

https[:]//technudge[.]pro

38.146.28[.]177

gitlab.tresalabs[.]com

2. Malware Files:

3. Additional Phishing Sites:

URI pattern analysis indicates this attack template entered operational use approximately four months before the current campaign.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates