"GitHub Warns of Lazarus Hackers Targeting Devs With Malicious Projects"

According to GitHub, a social engineering campaign is attempting to infect the devices of developers in the blockchain, cryptocurrency, online gambling, and cybersecurity industries with malware. The campaign has been attributed to the North Korean state-sponsored Lazarus Group, also known as Jade Sleet and TraderTraitor. The hacking group is known for targeting cryptocurrency companies and researchers to conduct cyber espionage and steal cryptocurrency. In a new security alert, GitHub warns that Lazarus Group is impersonating developers and recruiters on GitHub and social media by compromising legitimate accounts or creating fake personas. These personas are used to initiate conversations with targets. After gaining the target's trust, the threat actors invite them to collaborate on a project and clone a GitHub repository themed around media players and cryptocurrency trading tools. However, according to GitHub, these projects use malicious NPM dependencies that download malware. This article continues to discuss Lazarus hackers targeting developers with malicious projects. 

Bleeping Computer reports "GitHub Warns of Lazarus Hackers Targeting Devs With Malicious Projects"