“In an email exchange with ReversingLabs, he revealed that he had been contacted from a LinkedIn profile and provided with a link to the GitHub repository as a ‘homework task’,” the researchers said. “The developer was asked to ‘find the bug,’ resolve it and push changes that addressed the bug. When the changes were pushed, the fake recruiter asked him to send screenshots of the fixed bug — to make sure that the developer executed the project on his machine.”

Using PYC files to hide malicious code

Compared to the similar Node.js campaign reported by Securonix, in this case, attackers stored the malicious code in Python bytecode (PYC) files. This is significant because such files are in a binary format instead of plain text like typical source code files, making the malware much harder to spot.

PYC files are generated and cached when the Python interpreter imports or executes a Python script. Since they’re already interpreted (compiled) code, they can later be executed directly by the Python interpreter without reinterpreting the original script. This helps with performance because it has faster execution times, and the most common use for such files is in the distribution of Python modules. PYC files have been used by attackers to hide malicious code before.