Lazarus Group Unleashes New Malware Tactic Against Global Developers

**Executive Summary:** Operation Marstech Mayhem is a Lazarus Group supply-chain campaign that embeds a new implant, "Marstech1", in malicious GitHub repositories and NPM packages to infect developer systems, persist via a JavaScript loader connected to C2 infrastructure, and exfiltrate cryptocurrency wallet credentials and authentication tokens; the campaign uses sophisticated social engineering (LinkedIn/Discord), VPNs/proxies for evasion, and was linked to 233 victims across multiple countries in January 2025.