WageMole

Famous Chollima is a North Korea-aligned threat cluster associated with fraudulent IT worker operations, recruiter-themed social engineering, and developer-focused malware delivery. Widely used aliases include Wagemole, UNC5267, Nickel Tapestry, PurpleBravo, Storm-1877, Tenacious Pungsan, Void Dokkaebi, WaterPlum, BadClone, and DPRK IT worker network/operations. The activity is linked to the DPRK’s broader effort to generate illicit revenue, evade sanctions, infiltrate foreign companies, and in some cases obtain access that can support follow-on cyber operations. A defining characteristic of Famous Chollima is the use of fabricated or stolen identities, fake companies, AI-enhanced personas, and fraudulent résumés to secure remote employment, especially in technology, software development, blockchain, and Web3 roles. Operators have been observed posing as job seekers to obtain salaried positions inside Western firms, sometimes with assistance from facilitators outside North Korea. This activity has been tied to long-term access inside victim environments, illicit salary withdrawals, and attempts to leverage privileged access for malware deployment or broader intrusion support. The cluster is also associated with the Contagious Interview ecosystem, in which operators impersonate recruiters or business contacts and lure targets into fake interviews, coding tests, or technical assessments. These lures commonly pressure victims into executing malicious code locally, including ClickFix-style instructions to paste attacker-supplied commands into a terminal or run trojanized developer projects. Reported malware and related tooling associated with this ecosystem include BeaverTail, InvisibleFerret, OTTERCOOKIE-like payloads, PylangGhost, GolangGhost, DEV#POPPER, and OmniStealer. Observed capabilities include credential theft, cryptocurrency wallet theft, browser data theft, clipboard theft, keylogging in some malware sets, file exfiltration, remote shell access, persistence, and post-exploitation through modular RAT functionality. Famous Chollima-linked operations have also expanded into software supply chain compromise. Activity tracked as PolinRider has been tied to compromised maintainer accounts, tampered legitimate repositories, malicious npm, Go, Packagist, and browser-extension artifacts, hidden JavaScript loaders, Git history rewriting, and blockchain-based payload retrieval. These campaigns target developers and organizations that rely on trusted open-source packages, with the apparent goal of stealing developer secrets, cloud tokens, source code, browser sessions, and cryptocurrency assets while maintaining resilient access. Targeting consistently centers on software developers, cryptocurrency and blockchain organizations, Web3 firms, and technology companies, but reporting also shows interest in legal, advisory, compliance, investment, and business roles that may have access to wallets, sensitive data, or corporate systems. The actor’s dominant motivation is financial, although the access obtained through fraudulent employment and malware operations can also create opportunities for espionage or disruptive follow-on activity in support of DPRK state objectives.