Operation MarstechMayhem is a Lazarus campaign disclosed in February 2025 that targets software developers and cryptocurrency assets through manipulated open-source repositories. Attackers promote convincing GitHub projects through developer-oriented platforms such as LinkedIn and Discord; running a cloned project silently executes obfuscated JavaScript and installs the multistage Marstech1 implant. Later stages select additional payloads for the host and steal cryptocurrency-wallet data and authentication credentials while maintaining access to the development environment. Base85 encoding, repeating-key XOR, control-flow flattening, self-invoking code, and anti-debugging features distinguish the campaign's effort to evade analysis.