FrostyFerret
FrostyFerret is a macOS-focused malware component associated with North Korean threat activity tracked as Lazarus, Contagious Interview, ClickFake Interview, WaterPlum, Famous Chollima, and BlockNovas-related operations. Public reporting describes it as part of fake job interview and video-assessment infection chains targeting cryptocurrency job seekers, software developers, and finance/technology personnel. In the March 2025 ClickFake Interview campaign, victims were lured via fake interview websites using ClickFix-style prompts; on macOS, a Bash installer downloaded and extracted malicious components, established LaunchAgent persistence, executed FrostyFerret, and then launched the GolangGhost backdoor. FrostyFerret was used to phish for the victim’s macOS system password by displaying a fake prompt claiming Chrome required camera/microphone access. Reporting states the entered password was exfiltrated to Dropbox even if empty or incorrect, and was likely intended for subsequent keychain access. Multiple sources place FrostyFerret alongside BeaverTail, InvisibleFerret, OtterCookie, and GolangGhost in DPRK-linked recruitment-themed malware operations, and later reporting notes BlockNovas used video assessments and ClickFix-related lures to distribute FrostyFerret and GolangGhost. High-confidence related artifacts mentioned in the content include a malicious archive named "nvidia-rc.update.zip" and reporting that port 8000 was used as a C2 port for the Golang FrostyFerret backdoor chain.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BlockNovas has been observed using video assessments to distribute FROSTYFERRET and GolangGhost using ClickFix-related lures...
On macOS, a Bash script downloads and extracts malicious components, then executes FrostyFerret to steal the system password before launching GolangGhost.
“Analyzing the Malicious FrostyFerret Payload ‘nvidia-rc.update.zip’ … Port 8000 is a C2 port for the Golang Frostyferret Backdoor…”
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
"...job-themed social engineering campaigns ... under the pretext of coding assignment or fixing an issue with their browser when turning on camera during a video assessment."
Execution
4 techniques
Execution
“curl … && powershell -Command ‘Expand-Archive…’ && wscript …”; “cmd /c node nvidia.js”; “nohup bash /var/tmp/coremedia.sh …”
Windows command: “powershell -Command "Expand-Archive…" && wscript …update.vbs”
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Credential Access
2 techniques
Credential Access
Collection
2 techniques
Collection
IOCs tracked for this family
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named malware family/tool referenced in DPRK Contagious Interview and ClickFix-related reporting.
FrostyFerret is a malware tool used by North Korean threat actors, often in conjunction with other malware such as BeaverTail and OtterCandy.
従来は…GolangGhostを中心に攻撃を行っており、macOSに対してはFrostyFerretを追加配布していました。
"...with additionally distributing FrostyFerret for macOS."
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.