GolangGhost Steals Chrome Secrets From macOS Keychain and Hijacks MetaMask Permissions

This report describes an active campaign attributed to North Korean-aligned Famous Chollima/Wagemole that targets cryptocurrency and Web3 professionals via fake interview pages; victims are tricked into pasting malicious commands that install GolangGhost on macOS (and PylangGhost on Windows). The malware steals browser credentials and wallet extension data (including MetaMask), abuses macOS Keychain, establishes persistence via Launch Agents, tampers with Chrome permissions to escalate access, and the report supplies domains, IPs, URLs, and numerous SHA-256 IoCs alongside recommended mitigations.