Malware News SOCRadar Threat Research Unit reported that the DPRK’s ClickFake Interview campaign now delivers PylangGhost on Windows and GolangGhost on macOS.

[Khushal]

Content source

https://socradar.io/blog/dprk-clickfake-pylangghost-golangghost-rats/

It is done via fake crypto job interviews, using modular RATs and extensive social engineering.

Who Needs a Job? DPRK ClickFake Interview Campaign Drops PylangGhost and GolangGhost RATs​

This article by SOCRadar Threat Research Unit (STRU) analyzes the latest ClickFake Interview campaign, a North Korean social engineering operation that targets cryptocurrency and Web3 professionals with fake job interviews. Operators posing as recruiters walk targets through a bogus skill assessment that ends in a copy-and-paste command, delivering the PylangGhost RAT on Windows and the GolangGhost RAT on macOS.

DPRK’s Famous Chollima Deploys RATs Through ClickFake Job Interviews

SOCRadar Threat Research Unit analyze the latest ClickFake Interview campaign, a North Korean social engineering operation that targets cryptocurrency...

socradar.io

North Korea, officially the Democratic People’s Republic of Korea (DPRK), is well known for their financially motivated cyber operations. To circumvent international sanctions, they persistently attack organizations to steal funds and support the regime’s missile, nuclear, and espionage programs. From historically targeting SWIFT transactions and ATMs, they now focus on stealing crypto assets, with $643M stolen so far this year.

To accomplish these attacks, since at least early 2023, their cyber operators heavily employ social engineering via fake remote IT workers working on various organizations (“North Korean IT Worker Scheme”), fake technical interviews (“Contagious Interview”) and code supply chain attacks (e.g., the Polin Rider campaign) to reach developers employed at their targets of interest; and fake non-technical interviews (“ClickFake Interview“) to reach crypto and Web3 audiences directly.

Financially motivated DPRK campaigns
In this blogpost we analyze their latest iteration of ClickFake Interview, conducted by Famous Chollima targeting professionals in the crypto sector via ClickFix lures, delivering PylangGhost (for Windows) and GolangGhost (for macOS) Remote Access Trojans (RATs).

Key Points​

• Famous Chollima (aka Wagemole) is a North Korean-aligned threat actor that has been highly active through the Contagious Interview and the latest ClickFake Interview campaigns.
• For ClickFake Interview the actors are creating fraudulent companies or impersonating known ones in the crypto industry, and reach out to targets on social media (e.g., LinkedIn), inviting them to ClickFix empowered fake skill assessments.
• Their ClickFix panels incorporate gating, tailored questions based on advertised roles, psychological pressure to act fast, video recording, and social engineering that pushes targets to run malicious commands through fake camera errors.
• The final payloads target both Windows, by deploying PylangGhost RAT, and macOS, by deploying GolangGhost RAT alongside a credential-harvesting SwiftUI application.
• PylangGhost and GolangGhost consist of six interconnected modules: a main orchestrator, a configuration holder, an archive helper, a command launcher, a C2 component, and a stealer.
• Both payload chains download the runtimes needed to run in victim environments: Python’s interpreter for PylangGhost and Golang’s compiler for GolangGhost.
• In the latest variation of PylangGhost, the attackers also compiled their payloads as Python dynamic modules with Nuitka to further complicate detection and analysis.
• Famous Chollima actors register multiple domains for their fake skill assessments, predominantly on Hostinger and NameCheap registrars, emphasizing speed and scale, rather than operational security and infrastructure resilience.

 

[Bot]

Important warning for crypto and Web3 professionals

This campaign highlights why a fake technical or non-technical interview can still become a malware-delivery mechanism. A recruiter or interviewer should never require a candidate to paste commands into PowerShell, Terminal, Command Prompt, or a browser’s developer console to “fix” a camera, microphone, or assessment problem.

Recommended precautions

• Do not execute copy-and-paste commands supplied through an interview chat, website, or video call.
• Verify the company and recruiter through independently obtained contact details, not links or contact information provided during the interview.
• Treat unexpected requests to install runtimes, browser extensions, meeting tools, screen-recording software, or “assessment” applications as suspicious.
• Use a separate, non-privileged device or virtual machine for legitimate testing, and do not expose cryptocurrency wallets, private keys, seed phrases, or password-manager data.
• If a command was already executed, disconnect the device from the network and perform a full scan with reputable security software. From a known-clean device, change potentially exposed passwords and revoke active sessions and cryptocurrency credentials.
• Submit suspicious files, URLs, and commands to VirusTotal where appropriate, while avoiding the upload of confidential data or private keys.

The modular design described in the article also means that the initial launcher may not contain all malicious functionality. Absence of an obvious payload in the first file should not be treated as proof that the interview package is safe.

The key takeaway is simple: legitimate employers may provide coding exercises, but they should not pressure candidates into bypassing browser or operating-system safeguards by manually executing untrusted commands.

 

[Victor M]

If these fake interviews are so successful in reaching their ultimate goal to steal funds, how come we never hear about them ? Surely crypto company compromised by developer's infected machine would be a headline.