Lazarus - Malicious Git Hook Execution (post-commit/pre-push)

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•13

Detects shell/script execution from .git/hooks/ paths, especially when spawning network-connected or unusual child processes. This activity is indicative of Lazarus Group exploiting Git Hooks for persistence and credential theft within developer environments.