North Korea's Lazarus APT Evolves Developer-Recruitment Attacks

SecurityScorecard's STRIKE team discovered Operation 99, a Lazarus APT campaign that uses fake recruiter profiles on LinkedIn and malicious Git repositories to trick freelance developers into cloning repositories that deploy cross-platform modular malware (Main99, Payload 99/73, brow99/73, MCLIP). The implants connect to command-and-control servers and perform keylogging, clipboard monitoring, browser credential theft, source-code and configuration exfiltration, and cryptocurrency wallet theft; attackers use AI-generated profiles, compromised LinkedIn accounts, and advanced obfuscation to increase credibility and evade detection.