North Korean threat actors have introduced a stealthy new delivery mechanism in their ongoing “Contagious Interview” campaign, shifting tactics to abuse Git hooks for malware execution.
The attack begins with a familiar social engineering lure. Victims, often developers targeted through fake job interviews, are asked to clone a GitHub repository containing a “coding assessment.” Hidden within the repository is a malicious .git hooks/pre-commit script.
Unlike bulky payloads used in earlier campaigns, this script is intentionally minimal. It fingerprints the victim’s operating system using the uname -s command.
Instead, they are embedding a lightweight loader inside Git pre-commit hooks, allowing malware to execute before a developer even finalizes a commit.
It retrieves a platform-specific payload from a remote server hosted at precommit[.]vercel.app. Depending on the OS, the script uses tools like curl or wget to fetch and execute the next-stage malware directly in the shell or Windows command environment.
Security researchers from the OpenSourceMalware team report that attackers are no longer relying on VS Code task files, npm postinstall scripts, or disguised font files.
This design allows attackers to deliver tailored payloads: Bash scripts for macOS and Linux systems, and batch-compatible commands for Windows environments running Git Bash, MSYS, or Cygwin.
The inclusion of a flag=5 parameter in the URL likely helps operators track campaign variants or infection sources, a tactic observed in earlier DPRK-linked operations.
A key feature of the malicious hook is its stealth. All output is redirected to /dev/null, ensuring no visible signs of execution.
Additionally, the script always returns a successful exit code, allowing the Git commit process to proceed normally. This minimizes suspicion, as developers see no errors or interruptions.
The use of precommit[.]vercel.app adds another layer of deception. The domain appears legitimate at first glance, mimicking the widely used “pre-commit” framework.
However, it is actually a disposable Vercel deployment controlled by attackers, enabling them to host and rotate payloads with minimal infrastructure dynamically.
Git Hooks Abused
Git hooks provide an ideal execution point for attackers. They are deeply integrated into developer workflows and commonly used in modern projects through tools like Husky and lint-staged. As a result, the presence of a .githooks directory rarely raises suspicion.
More importantly, hooks execute automatically during routine actions like committing code precisely the behavior expected in a coding assignment.
Many developers configure hooks using git config core.hooksPath .githooks without inspecting their contents, creating an easy path for exploitation.
This shift also helps attackers bypass recent security improvements in development tools. As platforms like Visual Studio Code tighten controls around auto-executing tasks, threat actors are pivoting to less scrutinized features within the software development lifecycle.
These repositories follow a consistent pattern: minimal commit history, realistic project structures, and tasks requiring local code execution.
In some cases, attackers also deploy post-checkout hooks, which trigger whenever a user switches branches making them even more dangerous due to their frequent execution.
Researchers identified multiple GitHub containing identical malicious pre-commit hooks, all linked to newly created accounts and themed around cryptocurrency or DeFi projects.
This campaign highlights the growing risk of supply chain-style attacks targeting individual developers. Security experts strongly advise treating any interview-related repository as potentially malicious, especially in high-risk sectors like crypto and Web3.
Before running or committing code, developers should inspect directories such as .githooks, .husky, and .vscode, along with any installation scripts.
Executing unknown projects inside isolated virtual machines without access to sensitive credentials, SSH keys, or crypto wallets can significantly reduce risk.
The evolution of the Contagious Interview campaign underscores how threat actors continue to exploit trust in everyday development tools turning routine workflows into powerful infection vectors.
IOCs
TypeIndicator / ValueC2 URLhxxps://precommit[.]vercel.app/settings/mac?flag=5C2 URLhxxps://precommit[.]vercel.app/settings/linux?flag=5C2 URLhxxps://precommit[.]vercel.app/settings/windows?flag=5C2 Domainprecommit[.]vercel.appFile path.githooks/pre-commitFile hash (SHA-256)3ebd9bb57d155cc7c3353660f54c153a094cdfbd
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.