Loading malware…
PylangGhost is a modular, Python-based remote access trojan targeting Windows systems, identified in May 2025 and associated with the North Korean-aligned threat actor Famous Chollima. It is functionally similar to GolangGhost and is used in Contagious Interview and ClickFake Interview operations targeting software developers, job seekers, and cryptocurrency, blockchain, and Web3 professionals. Early observed infections were concentrated in India; subsequent activity also involved malicious npm packages.
Its recruitment-based infection chains impersonate employers and recruiters, directing targets to fraudulent interview or skills-assessment websites. Fabricated camera or microphone errors prompt victims to execute purported troubleshooting commands using ClickFix-style social engineering. The Windows chain downloads an archive, unpacks a bundled Python runtime, and executes the malware through Visual Basic Script. Later variants use Nuitka-compiled Python modules to complicate detection and analysis. Separate distribution chains deliver PylangGhost through malicious npm dependencies, including campaigns abusing Cloudflare Pages and Workers.
PylangGhost supports remote shell execution, system profiling, bidirectional file transfer, browser-data theft, and persistence through a Windows logon autorun entry. Its six-component architecture separates orchestration, configuration, archiving, command execution, command-and-control communications, and data theft. It communicates over HTTP using RC4-encrypted messages with MD5 integrity checks. Its stealing component collects saved credentials, authentication cookies, and data associated with more than 80 browser extensions, including cryptocurrency wallets and password managers. Windows-focused variants can bypass Chrome App-Bound Encryption to recover protected browser secrets. These capabilities expose personal and organizational accounts, sensitive files, and cryptocurrency-related secrets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Cisco Talos described PylangGhost as a Python variant that is functionally similar to GolangGhost.”
So on Windows, you end up with a remote access Trojan called PyLangGhost, which is written in Python.
"North Korea's abuse of Cloudflare Workers and Pages" published by Kmsec. #FamousChollima, #NPM, #PylangGhost, #DPRK, #CTI
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Famous Chollima... create an entirely fake business... or they impersonate a real one in the cryptocurrency sector... they go looking for potential targets on LinkedIn... The hackers, they're posing as recruiters. They pitch a lucrative new role.
Famous Chollima actors rely on social engineering, posing as potential recruiters to convince targets into a skill assessment, part of a fake interview, and run malicious payloads... reach out to their targets via social media (LinkedIn, Discord, Telegram and Email).
it pastes something from your clipboard into your terminal screen, the Run command, in order to download a piece of malicious code.
The script utilizes native system utilities like PowerShell or curl to fetch a compressed ZIP archive from the attacker's server.
ClickFix instructions included the download of the ZIP file via curl.
It then leverages a Visual Basic Script to silently unpack a Python runtime.
This is when the ClickFix attack is launched: the attackers send the victim instructions to paste a command into their computer, which will result in malware installation.
The auto module of both variants, actively attempts to elevate its privileges by temporarily impersonating the Windows lsass.exe process to gain SYSTEM-level access, and interacts directly with the Windows Cryptography API to unwrap the browser’s master decryption key.
Both variants have a util module that is responsible for compressing and decompressing files.
They occasionally create fake front companies or impersonate known ones in the crypto and Web3 industries, and reach out to their targets via social media.
The actors renamed CPython executable to ‘ chost.exe ‘.
The auto module of both variants, actively attempts to elevate its privileges by temporarily impersonating the Windows lsass.exe process to gain SYSTEM-level access, and interacts directly with the Windows Cryptography API to unwrap the browser’s master decryption key.
It is specifically programmed to harvest session data, saved credentials and private keys from widely used cryptocurrency wallets such as MetaMask, Phantom and TronLink, as well as commercial password managers like NordPass.
The group infiltrates job seekers' computer networks, harvesting sensitive information and stealing cryptocurrency; successful infections enable intellectual-property theft.
If you try and copy and paste that link from the web interface, what actually gets copied into your clipboard is something else. And that command, which you then paste in at the command prompt... is downloading from another site entirely.
Both PylangGhost and GolangGhost are built on a highly modular architecture consisting of six interconnected parts. These components include a main orchestrator, a dedicated configuration holder, an archive helper, a command launcher, a command-and-control (C2) communications module and a specialized data stealer.
142 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Python-based Windows RAT functionally similar to GolangGhost. Delivered in Famous Chollima fake job-interview campaigns through commands presented as camera-error fixes.
The post links to Atlassian's "Disrupting Contagious Interview" publication and tags #PylangGhost alongside other malware names.
A malware family delivered to targets who complete malicious job assessments in the Contagious Interview campaign.
A remote access trojan delivered via ClickFix-style social engineering in a fake job interview campaign attributed to Famous Chollima.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.