Skip to main content
Mallory
Back to malware
MalwareUsed by 4 actors

GolangGhost

Also known asFlexibleFerretWeaselStore

GolangGhost is a Go-based backdoor/RAT associated with the DPRK-linked Contagious Interview / DeceptiveDevelopment activity cluster and related reporting on Famous Chollima, WaterPlum/PurpleBravo, and Lazarus-aligned operations. It is also referred to as FlexibleFerret and WeaselStore, with reporting describing FlexibleFerret as the broader malware family and GolangGhost as its Go variant; the Python counterpart is commonly called PylangGhost. Public reporting ties it to fake job interview and recruitment lures targeting software developers, especially in cryptocurrency, blockchain, Web3, finance, technology, and AI-related organizations, often via malicious GitHub/GitLab/Bitbucket repositories, fraudulent coding assessments, fake interview websites, npm packages, ClickFix-style instructions, and abused Visual Studio Code workflows.

Across the cited reporting, GolangGhost/FlexibleFerret is described as a modular backdoor and infostealer with encrypted HTTP(S), TCP, or HTTP POST-based command and control, depending on the variant/report. Documented capabilities include remote command execution, plugin loading, file upload and download, continued C2 communication as a RAT, system discovery, and theft of browser data and cryptocurrency wallet data. Multiple sources specifically state it steals Chrome/Chromium credentials, cookies, browser extension data, and wallet artifacts; some reporting notes it is based on or leverages the open-source HackBrowserData project for Chrome data theft. Microsoft reporting also states FlexibleFerret establishes persistence through Windows RUN registry modifications, while macOS-focused reporting describes LaunchAgent persistence. In ClickFake Interview reporting, GolangGhost on Windows and macOS communicated with hardcoded C2 endpoints over HTTP POST and used RC4 with a per-request 128-byte key plus MD5 checksum; reported C2s included 38.134.148[.]218:8080, 154.62.226[.]22:8080, and 72.5.42[.]93:8080. Jamf reported a macOS FlexibleFerret/GolangGhost iteration contacting 95.169.180[.]140:8080 after execution from /var/tmp/macpatch.sh and related staging from app.zynoracreative[.]com, with persistence via ~/Library/LaunchAgents/com.driver9990as7tpatch.plist.

The malware has been observed in campaigns using fake recruiters and interview processes, including Contagious Interview and ClickFake Interview, and has been linked in reporting to clusters such as BlockNovas/WaterPlum Cluster B. Victims are commonly developers or job seekers, and several reports emphasize risk to employers when coding challenges are executed on corporate devices. Related malware frequently seen alongside GolangGhost in the same ecosystem includes BeaverTail, InvisibleFerret, OtterCookie, FrostyFerret, and PylangGhost.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Contagious Interview

UNK_DeadDrop Contagious Interview Targeting Software developers, security researchers, AI engineers in cryptocurrency Developers in cryptocurrency and AI ... Payload Overlord (Go binaries) OtterCookie (JavaScript), Invisible Ferret (Python), FlexibleFerret (Go/Python)

via proofpointproofpoint.com
ClickFake Interview

BlockNovas has been observed using video assessments to distribute FROSTYFERRET and GolangGhost using ClickFix-related lures...

via the hacker newsthehackernews.com
Lazarus

ClickFake Interview leverages fake job interview websites to deploy a Go backdoor – GolangGhost – on Windows and macOS environments... This final implant enables remote control and data theft, including browser information exfiltration. | Three variants, FriendlyFerret, FrostyFerret and FlexibleFerret, were deployed during a job interview process on a legitimate website.

via sekoia blogblog.sekoia.io
TraderTraitor

Lazarus Group Targets Job Seekers With ClickFix Tactic to Deploy GolangGhost Malware

via cloudatg insightscloudatg.com
MITRE ATT&CK

Techniques & procedures

29 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique
T1589Gather Victim Identity InformationEvidence1

“DeceptiveDevelopment steals victims' credentials to be used by WageMole in consequent social engineering.”

Resource Development

1 technique
T1586Compromise AccountsEvidence1

“Hijacked GitHub and social media accounts used to distribute malware.”

Initial Access

4 techniques
T1566PhishingEvidence2

"...job-themed social engineering campaigns ... under the pretext of coding assignment or fixing an issue with their browser when turning on camera during a video assessment."

T1566.001Spearphishing AttachmentEvidence1

“Fake job offers include attachments or links to malicious projects.”

T1566.002Spearphishing LinkEvidence2

“ClickFix technique uses deceptive links to fake troubleshooting guides.”

T1566.003Spearphishing via ServiceEvidence5

Multiple titles reference 'Contagious Interview,' 'fake developer job interviews,' 'LinkedIn recruiting scam,' 'Recruitment Emails,' and 'Job Offer' lures used to deliver BeaverTail, InvisibleFerret, OtterCookie, PylangGhost, and GolangGhost.

Execution

10 techniques
T1053Scheduled Task/JobEvidence1

Several titles explicitly mention 'VS Code Tasks Abuse,' 'Tracking the VS Code Tasks Infection Vector,' and 'Evolution of VS Code and Cursor Tasks Infection Chains.'

T1059Command and Scripting InterpreterEvidence3

“DeceptiveDevelopment uses VBS, Python, JavaScript, and shell commands for execution.”

T1059.001PowerShellEvidence1

“powershell -Command “Expand-Archive -Force -Path ‘%TEMP%\nvidiadrivers.zip’ …””

T1059.003Windows Command ShellEvidence1

“Open Command Prompt… use the following curl command… && powershell … && wscript …”

T1059.005Visual BasicEvidence1

“wscript “%TEMP%\nvidiadrivers\update.vbs”… “the downloader is launched by the update.vbs script”

T1059.006PythonEvidence1

Invisible Ferret is a Python-based backdoor used in later stages of the attack chain, enabling remote command execution.

T1059.007JavaScriptEvidence1

“cmd /c node nvidia.js. This downloader is built on the NodeJS Framework and fetches a ZIP archive…”

T1204User ExecutionEvidence4

persuading victims into running malicious commands or packages hosted on GitHub, GitLab, or Bitbucket as part of the assessment

T1204.001Malicious LinkEvidence2

“Victims are lured to fake job interview sites (e.g., ClickFix) that initiate malware download.”

T1204.002Malicious FileEvidence2

“Trojanized coding challenges contain variants of BeaverTail.”

Persistence

3 techniques
T1053Scheduled Task/JobEvidence1

Several titles explicitly mention 'VS Code Tasks Abuse,' 'Tracking the VS Code Tasks Infection Vector,' and 'Evolution of VS Code and Cursor Tasks Infection Chains.'

T1543.001Launch AgentEvidence1

“creates a plist file serving as a service, /Library/LaunchAgents/com.drive.plist, which points to a bash file named cloud.sh.”

T1547.001Registry Run Keys / Startup FolderEvidence2

FlexibleFerret establishes persistence through RUN registry modifications.

Privilege Escalation

3 techniques
T1053Scheduled Task/JobEvidence1

Several titles explicitly mention 'VS Code Tasks Abuse,' 'Tracking the VS Code Tasks Infection Vector,' and 'Evolution of VS Code and Cursor Tasks Infection Chains.'

T1543.001Launch AgentEvidence1

“creates a plist file serving as a service, /Library/LaunchAgents/com.drive.plist, which points to a bash file named cloud.sh.”

T1547.001Registry Run Keys / Startup FolderEvidence2

FlexibleFerret establishes persistence through RUN registry modifications.

Stealth

2 techniques
T1027Obfuscated Files or InformationEvidence1

“Obfuscated malicious scripts are hidden in long comments or outside IDE view.”

T1036MasqueradingEvidence2

“Malware disguised as legitimate software (e.g., conferencing tools, NVIDIA installers).”

Credential Access

1 technique
T1555.003Credentials from Web BrowsersEvidence1

“data theft, including browser information exfiltration”; “Chrome browser stealer capabilities based on the HackBrowserData project… COMMAND_AUTO Launch Chrome stealer… traces… AUTO_CHROME_KEYCHAIN…”

Discovery

2 techniques
T1057Process DiscoveryEvidence1

"Suspicious Process Discovery"

T1082System Information DiscoveryEvidence1

The malware operates as a lightweight command-and-control beacon capable of collecting host fingerprints, including hostname, network identifiers, operating system details, and public IP address.

Command and Control

3 techniques
T1071Application Layer ProtocolEvidence2

FlexibleFerret... leverages encrypted HTTP(S) and TCP command and control channels to dynamically load plugins, execute remote commands, and support file upload and download operations.

T1071.001Web ProtocolsEvidence3

“AkdoorTea, BeaverTail, and Tropidoor communicate with C&C servers over HTTP/S.”

T1105Ingress Tool TransferEvidence4

This task is configured so that it downloads data from a web application on Vercel ... Subsequently, it proceeds to launch a downloader, which periodically polls an external server to fetch a next-stage downloader ...

Exfiltration

3 techniques
T1041Exfiltration Over C2 ChannelEvidence1

Collected data is packaged and exfiltrated to attacker-controlled infrastructure via HTTP POST requests.

T1537Transfer Data to Cloud AccountEvidence1

The malware then steals API tokens, cloud credentials, crypto wallets, and source code.

T1567Exfiltration Over Web ServiceEvidence1

newer mutations of the VS Code projects have eschewed Vercel-based domains for GitHub Gist-hosted scripts to download and execute next-stage payloads

INDICATORS OF COMPROMISE

IOCs tracked for this family

87 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
64 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
17 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
6 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app27 days ago
domain●●●●●●●●●●●●View more in app2 months ago
domain●●●●●●●●●●●●View more in app2 months ago
domain●●●●●●●●●●●●View more in app2 months ago
domain●●●●●●●●●●●●View more in app2 months ago
domain●●●●●●●●●●●●View more in app2 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching87

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution4

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping29

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.