# Lazarus Targets Software Developers

An original poster reports a Lazarus/“Contagious Interview” campaign targeting developers with a trojanized Go assessment distributed alongside a task PDF. The reported attack chain includes weaponized Git hooks, blockchain-based command-and-control discovery, and credential- and wallet-stealing modules for macOS and Linux. The claims are the poster’s reporting and are not independently corroborated in the signal; it identifies no government agency, procurement action, contract, or solicitation. For procurement professionals, the report is relevant as cybersecurity risk intelligence for organizations and suppliers that develop software or handle source code and credentials, rather than as a direct purchasing opportunity.

- The post describes potential exposure in developer environments, including risks associated with repositories, Git hooks, and developer credentials; it also says defensive indicators are available, though the signal does not specify them.
- Government buyers and contractors can use the report as context when evaluating software-development security risks in supplier environments, without treating the reported activity as a verified finding or a new compliance mandate.
- No contract value, solicitation, deadline, agency requirement, or procurement contact is identified.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 15, 2026

### Key Quotes
> The threat actors distributed the repository as a direct ZIP archive alongside a task PDF.
> — Original poster

### Sources
- [[Threat Intel] Dissecting a 6-Stage Lazarus ("Contagious Interview") Kill Chain: From Weaponized Git Hooks to Dual-Blockchain EtherHiding (TRON/BSC) & macOS CDP Stealers](https://www.reddit.com/r/cybersecurity/comments/1x6snco/threat_intel_dissecting_a_6stage_lazarus) - reddit-cybersecurity