North Korean hackers adopt ClickFix attacks to target crypto firms

**Executive summary:** The North Korean Lazarus group is using ClickFix/ClickFake social‑engineering on fake interview sites to trick CeFi job candidates into executing commands (curl/PowerShell) that install a Go-based backdoor called GolangGhost which establishes persistence, communicates with C2, and harvests browser credentials and system data; Sekoia published technical analysis, Yara rules, and IoCs for detection.