North Korean Hackers Use Fake Job Interviews to Deploy PylangGhost and GolangGhost RATs
ID: 6a168fbc-4284-58eb-bc86-3398cbee03e4
STIX ID: report--6a168fbc-4284-58eb-bc86-3398cbee03e4
Feed Name: GBHackers
Executive summary: SOCRadar documents a sophisticated North Korea-linked operation called "ClickFake Interview" that targets Web3 and cryptocurrency professionals via fake recruitment workflows and staged video interviews; victims are tricked into running terminal commands that deploy platform-specific RATs (PylangGhost on Windows, GolangGhost on macOS) to harvest credentials, browser extension data (including crypto wallets) and session tokens, with telemetry noting ~230 professionals targeted and recommended mitigations to block terminal execution and restrict extensions.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.