GolangGhost

Famous Chollima actors register multiple domains for their fake skill assessments, predominantly on Hostinger and NameCheap registrars.

"DPRK’s Famous Chollima Deploys RATs Through ClickFake Job Interviews"

“Fake job offers include attachments or links to malicious projects.”

Famous Chollima sends malicious skill assessment URLs.

The attackers pose as recruiters, offer attractive roles, and direct targets to fake online skill assessments.

Several titles explicitly mention 'VS Code Tasks Abuse,' 'Tracking the VS Code Tasks Infection Vector,' and 'Evolution of VS Code and Cursor Tasks Infection Chains.'

On macOS, the copied command starts a Bash script that creates a hidden working directory, downloads a fake Intel driver archive, and retrieves the Go compiler needed to run GolangGhost.

At the final video-recording stage, the site displays a false camera error and persuades victims to copy and paste a supposed fix into their Mac Terminal.

“Trojanized coding challenges contain variants of BeaverTail.”

Targets are tricked into running malicious commands through fake camera error ClickFix lures.

Several titles explicitly mention 'VS Code Tasks Abuse,' 'Tracking the VS Code Tasks Infection Vector,' and 'Evolution of VS Code and Cursor Tasks Infection Chains.'

GolangGhost performs browser preference injection.

The script also establishes persistence through a Launch Agent, allowing the malware to restart after a reboot.

The malware injects broad permissions, including access to active tabs, clipboard writing, web requests, and expanded storage, then assigns them to the MetaMask extension.

Several titles explicitly mention 'VS Code Tasks Abuse,' 'Tracking the VS Code Tasks Infection Vector,' and 'Evolution of VS Code and Cursor Tasks Infection Chains.'

The auto module of both variants, actively attempts to elevate its privileges by temporarily impersonating the Windows lsass.exe process to gain SYSTEM-level access, and interacts directly with the Windows Cryptography API to unwrap the browser’s master decryption key.

The script also establishes persistence through a Launch Agent, allowing the malware to restart after a reboot.

Both variants have a util module that is responsible for compressing and decompressing files.

The auto module of both variants, actively attempts to elevate its privileges by temporarily impersonating the Windows lsass.exe process to gain SYSTEM-level access, and interacts directly with the Windows Cryptography API to unwrap the browser’s master decryption key.

GolangGhost runs commands like ‘ sysctl ‘ to identify VM/researcher environments.

The malware injects broad permissions, including access to active tabs, clipboard writing, web requests, and expanded storage, then assigns them to the MetaMask extension.

The campaign also launches a fake macOS application that requests administrator credentials under the guise of an update. Those credentials are sent to attacker-controlled infrastructure

macOS chain included a SwiftUI app that prompts for user credentials.

It then applies that secret to decrypt Chrome’s local database, exposing saved browser credentials and cookies that may grant access to online services.

GolangGhost can use the macOS Keychain command-line utility to retrieve Chrome’s stored master password.

GolangGhost can use the macOS Keychain command-line utility to retrieve Chrome’s stored master password.

It then applies that secret to decrypt Chrome’s local database, exposing saved browser credentials and cookies that may grant access to online services.

The malware injects broad permissions, including access to active tabs, clipboard writing, web requests, and expanded storage, then assigns them to the MetaMask extension.

They collect personal information, fingerprint the visitor’s browser and device, block mobile users, show timed assessment questions, and display warnings when candidates switch browser tabs.

COMMAND_INFORMATION - collect information about the infected system, username, OS version etc ... COMMAND_FILE_UPLOAD - file upload COMMAND_FILE_DOWNLOAD - file download

GolangGhost runs commands like ‘ sysctl ‘ to identify VM/researcher environments.

The malware also searches for browser extension data associated with cryptocurrency wallets and password managers.

The campaign also launches a fake macOS application that requests administrator credentials under the guise of an update. Those credentials are sent to attacker-controlled infrastructure

macOS chain included a SwiftUI app that prompts for user credentials.

PylangGhost compresses directories with stolen data into a single archive ( gather.tar.gz ) and queues it for exfiltration.

C2 communication occurs via HTTP.

the copied command starts a Bash script that creates a hidden working directory, downloads a fake Intel driver archive, and retrieves the Go compiler needed to run GolangGhost.

The actors used port 8080 for HTTP C2.

Both variants use RC4 encryption over HTTP POST requests for obfuscated C2 communication.

Those credentials are sent to attacker-controlled infrastructure, adding another path to account takeover and device control.

newer mutations of the VS Code projects have eschewed Vercel-based domains for GitHub Gist-hosted scripts to download and execute next-stage payloads