News for hackers. Stuff that matters.

A comment on Fake recruiter Lazarus lured aerospace employee with trojanized coding challenge. Parent comment

Re:Fake recruiter Lazarus lured aerospace employee with troj... by mlhpdx on Saturday September 30, 2023 @11:14PM (#37722191)
At first I thought this was more clever than it was. Taking people into running downloaded or attached exe files is simple and apparently still effective.

But what would be even more wicked, and effective would be pointing them to a GitHub repo with the “challenge” project to complete, and referencing a compromised package that does their bidding as the victim tests their solution.

[ Parent | on HN ]
Re:Fake recruiter Lazarus lured aerospace employee with troj... by hahn-kev on Sunday October 01, 2023 @04:33AM (#37723966)
Yeah I was thinking about that. Even asking me to use a specific package for any reason, I probably wouldn't think much of that before today. However now I'd certainly question it.
[ Parent | on HN ]