Loading malware…
GolangGhost is a modular, Go-based remote access trojan associated with the North Korea-aligned threat actor Famous Chollima and its Contagious Interview and ClickFake Interview operations. It is the Go variant of the FlexibleFerret malware family, also known as WeaselStore; the related Python variant is called PylangGhost. GolangGhost supports remote command execution, file transfer, system information collection, browser-data theft, and encrypted HTTP command-and-control communications. Its cross-platform code includes Windows, macOS, and Linux functionality, with macOS prominently targeted in recruitment campaigns.
Attackers impersonate recruiters and direct cryptocurrency and Web3 professionals to fraudulent interview or skills-assessment portals. Fabricated camera or microphone errors prompt victims to execute supposed diagnostic or driver-update commands using ClickFix social engineering. On macOS, installation scripts can download the Go compiler to execute the malware and establish persistence through a Launch Agent. An accompanying decoy application solicits and exfiltrates administrator credentials.
GolangGhost retrieves Chrome's stored encryption secret from the macOS Keychain to decrypt saved credentials and session cookies. It also harvests cryptocurrency-wallet and password-manager extension data and can modify Chrome's configuration to grant expanded permissions to MetaMask. Its Linux code accesses desktop secret services for credential decryption. Additional functionality includes virtual-machine and sandbox checks. The campaigns target software developers as well as investment, advisory, legal, and other business-facing professionals with access to digital assets and organizational accounts.
5 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
That software update is malware known as FrostyFerret in Mac and GolangGhost in Windows.
If you're on a Mac, it's GoLangGhost, which is a remote access Trojan written in Go.
BlockNovas has been observed using video assessments to distribute FROSTYFERRET and GolangGhost using ClickFix-related lures...
ClickFake Interview leverages fake job interview websites to deploy a Go backdoor – GolangGhost – on Windows and macOS environments... This final implant enables remote control and data theft, including browser information exfiltration. | Three variants, FriendlyFerret, FrostyFerret and FlexibleFerret, were deployed during a job interview process on a legitimate website.
Lazarus Group Targets Job Seekers With ClickFix Tactic to Deploy GolangGhost Malware
51 distinct techniques documented for this family, organized by ATT&CK tactic.
“DeceptiveDevelopment steals victims' credentials to be used by WageMole in consequent social engineering.”
Famous Chollima actors register multiple domains for their fake skill assessments, predominantly on Hostinger and NameCheap registrars.
“Hijacked GitHub and social media accounts used to distribute malware.”
the TraderTraitor operators invited the victims to collaborate on a GitHub repository that contained malicious JavaScript packages sourced from npm as dependencies [T1195.001]
Famous Chollima... create an entirely fake business... or they impersonate a real one in the cryptocurrency sector... they go looking for potential targets on LinkedIn... The hackers, they're posing as recruiters. They pitch a lucrative new role.
“Fake job offers include attachments or links to malicious projects.”
Famous Chollima sends malicious skill assessment URLs.
The attack begins on mainstream professional networks and communication platforms, including LinkedIn, Telegram, Discord and direct email. Posing as recruiters from reputable firms or creating entirely fictitious web companies, the actors reach out to developers and administrators.
Several titles explicitly mention 'VS Code Tasks Abuse,' 'Tracking the VS Code Tasks Infection Vector,' and 'Evolution of VS Code and Cursor Tasks Infection Chains.'
it pastes something from your clipboard into your terminal screen, the Run command, in order to download a piece of malicious code.
“powershell -Command “Expand-Archive -Force -Path ‘%TEMP%\nvidiadrivers.zip’ …””
“Open Command Prompt… use the following curl command… && powershell … && wscript …”
On macOS, the copied command starts a Bash script that creates a hidden working directory, downloads a fake Intel driver archive, and retrieves the Go compiler needed to run GolangGhost.
“wscript “%TEMP%\nvidiadrivers\update.vbs”… “the downloader is launched by the update.vbs script”
Invisible Ferret is a Python-based backdoor used in later stages of the attack chain, enabling remote command execution.
“cmd /c node nvidia.js. This downloader is built on the NodeJS Framework and fetches a ZIP archive…”
To resolve the issue and continue with the interview, the page displays a helpful prompt instructing the candidate to copy and paste a diagnostic command into their system terminal.
“Victims are lured to fake job interview sites (e.g., ClickFix) that initiate malware download.”
Targets are instructed to complete a job assessment or coding test, triggering a multi-step infection chain.
The page claims a Windows camera-driver race condition and tells the user to press Win+X, then A, and paste a driver-update command.
Several titles explicitly mention 'VS Code Tasks Abuse,' 'Tracking the VS Code Tasks Infection Vector,' and 'Evolution of VS Code and Cursor Tasks Infection Chains.'
GolangGhost performs browser preference injection.
The script also establishes persistence through a Launch Agent, allowing the malware to restart after a reboot.
FlexibleFerret establishes persistence through RUN registry modifications.
The malware injects broad permissions, including access to active tabs, clipboard writing, web requests, and expanded storage, then assigns them to the MetaMask extension.
Several titles explicitly mention 'VS Code Tasks Abuse,' 'Tracking the VS Code Tasks Infection Vector,' and 'Evolution of VS Code and Cursor Tasks Infection Chains.'
The auto module of both variants, actively attempts to elevate its privileges by temporarily impersonating the Windows lsass.exe process to gain SYSTEM-level access, and interacts directly with the Windows Cryptography API to unwrap the browser’s master decryption key.
The script also establishes persistence through a Launch Agent, allowing the malware to restart after a reboot.
FlexibleFerret establishes persistence through RUN registry modifications.
“Obfuscated malicious scripts are hidden in long comments or outside IDE view.”
Both variants have a util module that is responsible for compressing and decompressing files.
“Malware disguised as legitimate software (e.g., conferencing tools, NVIDIA installers).”
The auto module of both variants, actively attempts to elevate its privileges by temporarily impersonating the Windows lsass.exe process to gain SYSTEM-level access, and interacts directly with the Windows Cryptography API to unwrap the browser’s master decryption key.
GolangGhost runs commands like ‘ sysctl ‘ to identify VM/researcher environments.
The malware injects broad permissions, including access to active tabs, clipboard writing, web requests, and expanded storage, then assigns them to the MetaMask extension.
The campaign also launches a fake macOS application that requests administrator credentials under the guise of an update. Those credentials are sent to attacker-controlled infrastructure
macOS chain included a SwiftUI app that prompts for user credentials.
It is specifically programmed to harvest session data, saved credentials and private keys from widely used cryptocurrency wallets such as MetaMask, Phantom and TronLink, as well as commercial password managers like NordPass.
It is specifically programmed to harvest session data, saved credentials and private keys from widely used cryptocurrency wallets such as MetaMask, Phantom and TronLink, as well as commercial password managers like NordPass.
GolangGhost can use the macOS Keychain command-line utility to retrieve Chrome’s stored master password.
It then applies that secret to decrypt Chrome’s local database, exposing saved browser credentials and cookies that may grant access to online services.
The malware injects broad permissions, including access to active tabs, clipboard writing, web requests, and expanded storage, then assigns them to the MetaMask extension.
On Apple devices, the infection process often installs the primary payload alongside a credential-harvesting helper application built with SwiftUI, which is specifically designed to trick macOS users into surrendering their administrative passwords.
"Suspicious Process Discovery"
They collect personal information, fingerprint the visitor’s browser and device, block mobile users, show timed assessment questions, and display warnings when candidates switch browser tabs.
COMMAND_INFORMATION - collect information about the infected system, username, OS version etc ... COMMAND_FILE_UPLOAD - file upload COMMAND_FILE_DOWNLOAD - file download
GolangGhost runs commands like ‘ sysctl ‘ to identify VM/researcher environments.
The group infiltrates job seekers' computer networks, harvesting sensitive information and stealing cryptocurrency; successful infections enable intellectual-property theft.
The campaign also launches a fake macOS application that requests administrator credentials under the guise of an update. Those credentials are sent to attacker-controlled infrastructure
macOS chain included a SwiftUI app that prompts for user credentials.
If you try and copy and paste that link from the web interface, what actually gets copied into your clipboard is something else. And that command, which you then paste in at the command prompt... is downloading from another site entirely.
Both PylangGhost and GolangGhost are built on a highly modular architecture consisting of six interconnected parts. These components include a main orchestrator, a dedicated configuration holder, an archive helper, a command launcher, a command-and-control (C2) communications module and a specialized data stealer.
FlexibleFerret... leverages encrypted HTTP(S) and TCP command and control channels to dynamically load plugins, execute remote commands, and support file upload and download operations.
C2 communication occurs via HTTP.
The multi-step infection chain leads to deployment of various malware families; backdoor access is abused to deliver remote access trojans.
Useful starting points are MITRE ATT&CK techniques for remote access software (T1219)
The actors used port 8080 for HTTP C2.
Both variants use RC4 encryption over HTTP POST requests for obfuscated C2 communication.
Those credentials are sent to attacker-controlled infrastructure, adding another path to account takeover and device control.
The malware then steals API tokens, cloud credentials, crypto wallets, and source code.
newer mutations of the VS Code projects have eschewed Vercel-based domains for GitHub Gist-hosted scripts to download and execute next-stage payloads
170 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
53 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.