North Korean ClickFake Campaign Targets Web3 Professionals with RATs

Researchers attribute an active campaign named ClickFake to North Korea’s Chollima group that lures Web3 and crypto professionals with fake job interviews on Telegram and Discord, coercing victims into running malicious terminal commands. The operation deploys PylangGhost on Windows and GolangGhost on macOS via interactive web portals, employs psychological pressure (countdowns, tab-switch warnings), and uses evasion techniques such as native DLL compilation, posing a targeted threat to cryptocurrency sector personnel and infrastructure.