Fake recruiter coding tests target devs with malicious Python packages

ReversingLabs details an active campaign (VMConnect) that distributes malicious Python packages and GitHub repos posing as developer coding tests and fake job interviews to trick developers into executing code; the malware (in __init__.py and .pyc files) contains Base64-encoded downloader functionality that contacts a C2 to execute commands and fetch further payloads. The report links the activity to North Korea’s Lazarus Group, describes evidence including a compromised developer and removed GitHub repositories, and warns that this supply-chain-style technique enables initial access and potential lateral movement to steal data or deploy backdoors.