Lazarus Group Targets Bitdefender Researcher with LinkedIn Recruiting Scam

Bitdefender researchers observed a sophisticated Lazarus campaign that lured developers via fake LinkedIn job offers to download a cross-platform infostealer. The initial payload harvested browser logins and cryptocurrency wallet data, then executed a Python staging script that loaded modules (mlip.py, pay.py, bow.py) for clipboard monitoring, system/file exfiltration and browser data theft; a .NET component disabled Defender, configured a Tor proxy, fingerprinted the host, and fetched additional modules including a backdoor, keylogger and cryptominer. The report highlights multi-language, multi-stage tactics consistent with nation-state operations and urges developers to avoid running unverified code or suspicious repositories.