North Korean Hackers Target LinkedIn Users With Fake Job Offers

Famous Chollima (DPRK) threat actors are conducting a ClickFake recruitment campaign that lures victims with fake interviews and skill assessments on LinkedIn and other platforms; during a final “ClickFix” step victims are instructed to paste commands that install remote access trojans (PylangGhost and GolangGhost). The campaign targets non-technical roles in crypto/Web3 and other industries and leverages impersonation of recruiters and front companies to deliver malware and gain access.