ClickFake Interview – Lazarus Hackers Exploit Windows and macOS Users Fake Job Campaign

The report documents Lazarus Group's "ClickFake Interview" campaign that lures cryptocurrency job seekers to fake ReactJS interview sites which prompt downloads that deploy a NodeJS/VBS chain on Windows and Bash/launchd on macOS to install the FrostyFerret stealer and GolangGhost backdoor; the malware provides remote control, credential/browser data theft, and RC4-encrypted C2 communications, and the campaign targets centralized finance platforms following prior large-scale thefts (including a reported $1.5B Bybit heist).