Loading story…
North Korean-linked threat actor Famous Chollima has been using fake job interviews and skill assessments to infect cryptocurrency and Web3 professionals with the PylangGhost and GolangGhost remote access trojans. Researchers said the operation impersonates firms including Coinbase, Robinhood, Uniswap, Archblock, and Parallel Studios, with lures delivered through LinkedIn, Discord, Telegram, email, and fraudulent interview sites. Victims are told to fix supposed camera or microphone problems by copying and pasting malicious commands, a ClickFix/ClickFake technique that installs malware on Windows and macOS systems; recent reporting said Linux was not targeted in the latest wave.
The malware provides remote shell access, file transfer, system reconnaissance, persistence, and theft of browser credentials, cookies, and data from more than 80 browser extensions, including cryptocurrency wallets and password managers. Reporting indicates PylangGhost is a Python-based RAT functionally similar to GolangGhost, while GolangGhost on macOS can also deploy a SwiftUI credential harvester; both families use encrypted HTTP-based command-and-control communications. Investigators also described tailored fake assessment panels, invite-link validation, browser fingerprinting, mobile-device blocking, countdown timers, clipboard hijacking, and typosquatted infrastructure hosted largely through providers such as Hostinger and NameCheap, underscoring a financially motivated DPRK campaign aimed at stealing cryptocurrency and gaining access to company funds.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On July 20, 2026, SOCRadar published an analysis of the ClickFake Interview campaign attributed to Famous Chollima, describing recruiter impersonation and fake interview workflows used to deploy PylangGhost on Windows and GolangGhost on macOS. The analysis also documented infrastructure patterns, browser fingerprinting, clipboard hijacking, and credential theft capabilities tied to the operation.
On June 18, 2025, Cisco Talos published a report detailing PylangGhost delivery via fake interview sites impersonating firms including Coinbase, Robinhood, Uniswap, Archblock, and Parallel Studios. The report included malware behavior, affected platforms, victimology, hashes, C2 infrastructure, download domains, fake interview domains, and ClamAV detections.
Cisco Talos reported that in May 2025 it identified PylangGhost, a Python-based remote access trojan used by the North Korean-aligned threat actor Famous Chollima/Wagemole. The malware was observed in fake job interview and skill-testing campaigns targeting cryptocurrency and blockchain job seekers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcebsky.app
Open sourcesocradar.io
Open sourceblog.talosintelligence.com
Open sourceunit42.paloaltonetworks.com
Open sourcetrmlabs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported the **first confirmed appearance of the PylangGhost remote access trojan on the npm registry**, where it was hidden in two malicious JavaScript packages: `@jaime9008/math-service` and `react-refresh-update`. The activity has been linked to **FAMOUS CHOLLIMA**, a North Korean state-sponsored threat group previously associated with developer-focused social engineering and trojanized software campaigns. The packages were reportedly uploaded by the user `jaime9008`, tied to the email `jaimeandujo086[@]gmail.com`, and contained a PylangGhost loader embedded in files including `runtime.js`, `babel.js`, and `lib/lib.js`. The reported campaign used the hardcoded identifier **"ML2J"** and communicated with infrastructure including `malicanbur[.]pro` and `173.211.46[.]22:8080`. The reporting indicates the npm activity represents an escalation of software supply chain targeting aimed at developers and development pipelines, extending a malware family that had previously been disclosed by Cisco Talos and attributed to the same DPRK-linked actor. A social post amplifying the Kmsec finding is consistent with that same event, while separate posts about **Konni** spear-phishing and KakaoTalk-linked activity describe a different DPRK-related campaign and are not part of this incident.
Jun 29, 2026
The North Korean state-sponsored hacking group known as Famous Chollima has been identified as orchestrating a sophisticated cyber campaign targeting individuals and organizations with the goal of stealing cryptocurrency and sensitive credentials. Security researchers have observed that the group is leveraging trojanized Node.js applications, such as fake versions of legitimate apps like Chessfi, to deliver malicious payloads. Victims are lured through job scam tactics, where they are enticed to install what appears to be a legitimate application, but which actually contains hidden malware. The infection process involves the user executing an 'npm install' command, which surreptitiously downloads a malicious package named 'node-nvm-ssh.' This package is engineered to execute a series of obfuscated commands, ultimately deploying the OtterCookie and BeaverTail malware families onto the victim's system. Recent analysis by Cisco Talos has revealed that the functionalities of BeaverTail and OtterCookie are being merged, indicating a strategic move by the attackers to streamline and enhance their toolset for future campaigns. The evolution of the OtterCookie malware has been particularly notable, with successive versions adding increasingly invasive capabilities. Early versions focused on stealing browser profiles, while later iterations introduced clipboard theft, file exfiltration from all mounted drives, and, most recently, advanced surveillance features. The latest version, designated V5, incorporates a keylogger to capture every keystroke and a screenshotting module that takes images of the victim's desktop every four seconds, with all collected data exfiltrated to the attackers' command and control infrastructure. The campaign has been observed targeting high-value individuals and organizations, with at least one confirmed infection at a Sri Lanka-based organization. The attackers' use of legitimate-looking applications and sophisticated evasion techniques makes detection and prevention challenging. The campaign's primary objective appears to be the theft of cryptocurrency and sensitive user credentials, which are highly valuable on underground markets. Security experts warn that the merging of malware capabilities and the use of evolving infection vectors signal an ongoing and escalating threat from the Famous Chollima group. Organizations are advised to implement robust endpoint protection, monitor for suspicious npm package installations, and educate users about the risks of unsolicited job offers and software downloads. The campaign underscores the persistent and adaptive nature of North Korean cyber operations, particularly in their pursuit of financial gain through cybercrime.
Jun 29, 2026
North Korea-linked **BlueNoroff** has been tied to two coordinated intrusion campaigns, **GhostCall** and **GhostHire**, aimed at blockchain developers, executives, managers, and venture capital contacts in the Web3 ecosystem as part of its broader **SnatchCrypto** activity. Researchers said GhostCall lured victims into fake Zoom or Microsoft Teams meetings arranged through Telegram and phishing domains, then tricked them into executing malicious AppleScript on macOS or clipboard-swapped commands on Windows. GhostHire used recruiter impersonation to deliver poisoned coding assignments through Telegram bots, GitHub repositories, and trojanized Go or TypeScript projects. The operations used overlapping infrastructure and a broad malware toolkit spanning at least seven modular macOS infection chains, with families including `DownTroy`, `ZoomClutch`, `TeamsClutch`, `CosmicDoor`, `RooTroy`, `RealTimeTroy`, `SneakMain`, `SysPhon`, and `SilentSiphon`, alongside a keylogger. The actor expanded beyond earlier standalone malware into modular launchers, loaders, droppers, injectors, and stealers written in AppleScript, Go, Nim, Rust, Swift, Python, and C++, and also extended tooling to Windows and Linux in GhostHire. Investigators also observed the use of AI to refine social engineering and enhance images, while stolen webcam footage from victims was reportedly reused in later fake calls to make the scams more convincing; victims were identified across multiple countries, particularly in the Asia-Pacific region.
Jun 29, 2026