Python Developers Targeted with Malware During Fake Job Interviews
Interesting social engineering attack: luring potential job applicants with fake recruiting pitches, trying to convince them to download malware. From a news article:
These particular attacks from North Korean state-funded hacking team Lazarus Group are new, but the overall malware campaign against the Python development community has been running since at least August of 2023, when a number of popular open source Python tools were maliciously duplicated with added malware. Now, though, there are also attacks involving “coding tests” that only exist to get the end user to install hidden malware on their system (cleverly hidden with Base64 encoding) that allows remote execution once present. The capacity for exploitation at that point is pretty much unlimited, due to the flexibility of Python and how it interacts with the underlying OS.
Subscribe to comments on this entry
Clive Robinson • September 17, 2024 8:49 AM
I’m surprised this has taken so long to appear as a risk.
This “solve a task we set in your own time” part of the software interview process started quite a while before 2019 but “Lockdown” pushed it to being “standard”.
If you think about it for a moment it’s an obvious “exploit path” to getting a backdoor “Remote Access Trojan”(RAT) onto a developers personal machine(s).
It’s just one reason why for years I’ve talked about the “Two Energy Gapped Computers” or “Strong Segregation Security” architecture. With one computer for “external communications” and one for “Private Work”.
As I’ve indicated in the past my own systems are completely segregated from all external communications, including the power grid and I’ve an established procedure for “gap crossing”.
Yes when I first talked about it many thought I was in effect paranoid, but here we are a decade later and the attackers have “eaten all the juicy low hanging fruit” so they are stretching their necks a little.
However I suspect this is not the first time this sort of attack has been used, certain European Cryptographers have suspicions around a well know European Telecommunications company. But it’s their story to tell.