Lazarus ClickFake Interview Campaign: ClickFix Malware

In March 2025 Sekoia documented the Lazarus-attributed "ClickFake Interview" campaign that lures cryptocurrency job seekers to ReactJS-based fake interview sites, uses a ClickFix social-engineering prompt to make victims run curl commands that fetch platform-specific payloads, and ultimately installs a Go interpreted backdoor (GolangGhost) and a macOS stealer (FrostyFerret); the report provides full infection-chain analysis, IoCs (domains, staging C2s, GolangGhost C2 IPs), file hashes, YARA detections, and hunting/detection guidance and links this activity to prior Contagious Interview operations.