Beware! Lazarus Hackers Use Fake Interviews “ClickFake” to Infect Windows & macOS with GO Malware

Lazarus has launched the "ClickFake Interview" campaign targeting cryptocurrency job seekers via fake ReactJS interview sites that trick victims into downloading malicious software; Windows victims receive a VBS/NodeJS chain delivering the GolangGhost backdoor, while macOS victims encounter FrostyFerret to harvest credentials before GolangGhost deployment. The report details the malware's encrypted C2, persistence via registry/plist entries, and the campaign's focus on CeFi targets as part of DPRK-linked financially motivated operations.