FAKE PASSWORD MANAGER CODING TEST USED TO HACK PYTHON DEVELOPERS

Summary from the TLDR InfoSec newsletter

The North Korean Lazarus hacking group launched a campaign where it approached Python developers with a coding interview challenge. The candidates were tasked with finding and fixing bugs in a password manager application that pulled in two malicious PyPi packages that executed an obfuscated C2 payload in their __init__.py. Candidates were rushed to complete the assignment due to tight deadlines listed in the README file that may have led to them skipping some security checks.