DPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams

Threat actors with ties to the Democratic People’s Republic of Korea have been observed leveraging ClickFix-style lures to deliver BeaverTail and InvisibleFerret, with targets in cryptocurrency marketing and trading roles rather than software developers, according to a report by a GitLab Threat Intelligence researcher Oliver Smith.

First exposed by Palo Alto Networks in late 2023, BeaverTail and InvisibleFerret have been deployed as part of a long-running Contagious Interview campaign (also known as Gwisin Gang) that distributes the malware to software developers under the pretext of a job assessment, and within this umbrella the group is assessed to be a subset of Lazarus.

The campaign has previously propagated BeaverTail via bogus npm packages and fraudulent Windows videoconferencing apps such as FCCCall and FreeConference, and the latest wave in late May 2025 used a compiled Windows/macOS/Linux binary delivered through a fake hiring platform web application built with Vercel.

In recent findings, the campaign’s targets include marketing applicants and impersonation of a retail sector organisation, with a variant of BeaverTail that focuses on eight browser extensions and loads Python dependencies from a password-protected archive to support InvisibleFerret, as described by GitLab and SentinelOne/Validin collaborators.

A separate North Korea–aligned Kimsuky operation has also been linked to ClickFix-based phishing and the use of GitHub repositories for powerShell-based downloads, highlighting an ongoing blend of espionage, data theft and credential harvesting across multiple campaigns.