Anatomy of a Git Hook Scam: How Malicious Assessments Target Web3 Developers

At ExtBit LLC, our core engineering philosophy is simple: /"Extend the bit, protect your data."/ Usually, we apply this to designing zero-trust enterprise architectures and secure Web3 protocols. But recently, we had to apply it to our own workstations during a live social-engineering attack on a freelance hiring platform.

This article breaks down a highly targeted malware campaign aimed at Web3, Solidity, and systems engineers. By understanding the mechanics of this Git-hook exploit, developers can protect their credentials, wallets, and clients' data.

1The Lure: The High-Ticket "Competency Assessment"

The attack begins with a standard technical recruitment pipeline. A prospective "client" reaches out for a senior engineering role—in this case, an EVM/Solidity architecture position for a parametric insurance protocol offering a lucrative $80–$130/hr rate.

After a brief technical exchange, the client requests a standard paid "competency assessment" and provides a Google Drive link to a zipped repository.

The first red flag? The Google Drive preview resolved to an unrelated, spoofed domain (dealsbe.com) instead of a standard GitHub repo.

2The Trap: "Just switch the branch"

Upon downloading and safely unpacking the archive (without executing any build commands), the project appeared mostly empty. Crucially, the README.md file was completely blank.

When informed that the instructions were missing, the client replied with the exact trigger for the exploit:

"Make sense. Please try to switch assessment branch, my apologies for not communicating this sooner. git checkout readme."

To a busy developer rushing to complete a technical test, running git checkout seems harmless. It is not an npm install, a docker build, or a compiled binary. It is just a branch switch.

And that is exactly what the attacker is counting on.

3The Technical Vector: Hidden .git/hooks

Before running the requested command, I manually inspected the hidden .git directory. The repository had no remote configuration, no legitimate commit history, and a broken working tree.

However, nestled inside the .git/hooks/ directory was a densely obfuscated executable script named post-checkout (and related hooks).

3.1How the Exploit Works

Git natively supports "hooks"—custom scripts that execute automatically when specific Git events occur.

  1. When a developer types git checkout readme, Git changes the working tree.
  2. Immediately afterward, Git silently looks for an executable file at .git/hooks/post-checkout.
  3. If the file exists, Git runs it locally with the full permissions of the current user.

Because the malicious payload was pre-packaged inside the .zip archive's .git folder, the developer does not need to download dependencies or compile code. The moment they switch branches, the malware detonates.

4The Fallout: What is the Payload?

These Git-hook payloads are specifically designed to target Web3 developers. Running silently in the background, the Node.js or bash scripts typically execute the following pipeline:

  1. Credential Harvesting: Scrapes ~/.ssh/id_rsa, AWS credentials, and local .env files containing production database passwords or API keys.
  2. Session Hijacking: Extracts browser session cookies, Discord/Telegram auth tokens, and Upwork/GitHub login sessions.
  3. Wallet Draining: Searches for and exfiltrates local wallet extension data (MetaMask, Phantom) and keystore files.

5How to Protect Yourself (The ExtBit Approach)

At ExtBit, we never execute unvetted external code on our primary hardware. To protect yourself and your organization from these supply-chain and social-engineering attacks, enforce the following protocols:

  1. Never run =git= commands on untrusted archives. If you are sent a zipped repository, assume the .git folder is compromised. Inspect the file tree in plain text using a safe editor without auto-compilation extensions enabled.
  2. Demand Plain-Text Scopes. Legitimate clients will provide technical requirements via standard channels (PDFs, plain text, public GitHub issues). If a client insists you run local scripts just to view the prompt, it is a scam.
  3. Use Disposable Environments. If you must run a technical assessment, execute it inside an isolated Docker container, a disposable virtual machine, or a cloud sandbox (like GitHub Codespaces) that has zero access to your primary file system or network credentials.
  4. Inspect Git Hooks. You can disable Git hooks globally or check them manually using ls -la .git/hooks/ before interacting with a downloaded repository.

By maintaining strict operational security and a zero-trust mindset, we successfully neutralized this attack without a single byte of data being compromised. Keep your guard up, inspect the bytes, and protect your data.