A new social engineering threat is targeting Python developers through deceptive recruitment tactics to promote malware downloads. This malicious activity is attributed to the Lazarus Group, a hacking team linked to North Korea. The group has recently expanded its operations, continuing a campaign that began in August 2023, which included the creation of counterfeit open-source Python tools embedded with malware.
The latest tactic involves fake “coding tests” designed solely to trick users into unknowingly installing hidden malware on their systems. This malware is cleverly concealed using Base64 encoding and enables remote execution once activated.
This situation raises significant concerns regarding exploitation possibilities, as the versatility of Python, combined with its interaction with the operating system, allows for extensive manipulation.