Fake password manager coding test used to hack Python developers

ReversingLabs and reporting detail a Lazarus APT campaign (VMConnect) that targets Python developers with fake password-manager coding tests hosted on GitHub and malicious PyPI packages; the README instructs victims to run a provided application which triggers a base64-obfuscated downloader embedded in library __init__.py files that contacts a command-and-control server. Attackers impersonate recruiters (including large banks) on LinkedIn and impose tight time limits to discourage code review; activity was observed as recently as July 31 and developers are advised to verify recruiters and execute untrusted code only in isolated sandboxes or VMs.