Lazarus Contagious Interview - git clone Followed by Immediate Code Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects a git clone operation performed in a potentially untrusted or sensitive directory (e.g., Desktop, Downloads, Temp) followed immediately by code execution using common interpreters (node, python, powershell). This behavior is consistent with the Lazarus Group 'Contagious Interview' campaign, where attackers lure developers into cloning and executing malicious code repositories via social engineering.