Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs

This Kaspersky threat intelligence report attributes two coordinated BlueNoroff operations—GhostCall and GhostHire—that target Web3/blockchain executives and developers using tailored social‑engineering (fake calls, recruiter assessments), Telegram bots, malicious GitHub dependencies, and multi‑stage cross‑platform malware (macOS, Windows, Linux). The actors employ sophisticated techniques (TCC DB bypass, process injection, UAC bypass, loaders/injectors written in Nim/C++/Go/Rust/Swift), a modular stealer suite (SilentSiphon), numerous C2 domains and file hosting services, and provided extensive IoCs and telemetry tying activity to BlueNoroff and financial motives.