The SOCRadar Threat Research Unit (STRU) published an in-depth analysis of the latest ClickFake interview campaign, a North Korean social engineering operation targeting cryptocurrency and Web3 professionals with fake job interviews.
In this campaign, operators pose as recruiters to walk targets through a bogus skill assessment that ends in a copy-and-paste command, delivering the PylangGhost RAT on Windows and the GolangGhost RAT on macOS.
Key points include:
- Famous Chollima (aka Wagemole) is a North Korean-aligned threat actor that has been highly active through the Contagious Interview and the latest ClickFake Interview campaigns.
- For ClickFake Interview the actors are creating fraudulent companies or impersonating known ones in the crypto industry, and reach out to targets on social media (e.g., LinkedIn), inviting them to ClickFix empowered fake skill assessments.
- Their ClickFix panels incorporate gating, tailored questions based on advertised roles, psychological pressure to act fast, video recording, and social engineering that pushes targets to run malicious commands through fake camera errors.
- The final payloads target both Windows, by deploying PylangGhost RAT, and macOS, by deploying GolangGhost RAT alongside a credential-harvesting SwiftUI application.
- PylangGhost and GolangGhost consist of six interconnected modules: a main orchestrator, a configuration holder, an archive helper, a command launcher, a C2 component, and a stealer.
- Both payload chains download the runtimes needed to run in victim environments: Python’s interpreter for PylangGhost and Golang’s compiler for GolangGhost.
- In the latest variation of PylangGhost, the attackers also compiled their payloads as Python dynamic modules with Nuitka to further complicate detection and analysis.
- Famous Chollima actors register multiple domains for their fake skill assessments, predominantly on Hostinger and NameCheap registrars, emphasizing speed and scale, rather than operational security and infrastructure resilience.
For full details, this study can be read here: https://socradar.io/blog/dprk-clickfake-pylangghost-golangghost-rats/
Related
This entry was posted on July 20, 2026 at 12:16 pm and is filed under Commentary with tags SOCRadar. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
DPRK ClickFake Interview Campaign Drops PylangGhost and GolangGhost RATs
The SOCRadar Threat Research Unit (STRU) published an in-depth analysis of the latest ClickFake interview campaign, a North Korean social engineering operation targeting cryptocurrency and Web3 professionals with fake job interviews.
In this campaign, operators pose as recruiters to walk targets through a bogus skill assessment that ends in a copy-and-paste command, delivering the PylangGhost RAT on Windows and the GolangGhost RAT on macOS.
Key points include:
For full details, this study can be read here: https://socradar.io/blog/dprk-clickfake-pylangghost-golangghost-rats/
Share this:
Like this:
Related
This entry was posted on July 20, 2026 at 12:16 pm and is filed under Commentary with tags SOCRadar. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.