RESEARCHERS at SOCRadar have uncovered a sophisticated social engineering campaign attributed to the North Korean hacking group Famous Chollima, targeting Web3 and cryptocurrency professionals. The campaign involves fraudulent job interviews and interactive web portals that trick candidates into installing remote access trojans (RATs) on their devices. Unlike broad phishing attacks, this operation utilizes personalized recruitment scams to build trust with targets.
The attackers establish contact via professional networks, posing as legitimate recruiters and enticing candidates with lucrative offers. The malicious assessment platforms they use pressure candidates while triggering simulated errors to prompt them to execute harmful commands. For Windows users, this leads to an infection via scripts that download a Python-based RAT, while macOS users are targeted through commands that execute a Go-based RAT.
The modular malware suite includes features for financial gain, such as stealing credentials from cryptocurrency wallets. This campaign poses a risk not only to individuals but also to organizations, potentially enabling attackers to access company funds.