• •Open-Source Malware Blog reported that the Lazarus Group is leveraging Git hooks—scripts that execute during specific repository events—to maintain persistence on developer machines.
• •This method allows malicious code to trigger automatically during routine operations like 'git commit' or 'git push,' making detection difficult for standard security tools.
• •The full scope of affected organizations remains unclear, and researchers are still determining if this technique is being used for large-scale supply chain attacks or targeted corporate espionage.

The Lazarus Group has adopted Git hooks as a mechanism to execute malicious code within developer environments. Unlike traditional malware that relies on direct system access, this method embeds threats directly into the version control workflow. While effective for evading perimeter defense, the technique requires an initial compromise of a developer’s machine to modify repository hooks. It remains unknown how many development teams have been impacted or if this represents a permanent shift in the group's delivery tactics.