Got targeted by malware disguised as a "project for estimation" - fake client, real company, payload in .git/hooks