North Korean Hackers Evolve Tactics with New Malware Campaign

GitLab Threat Intelligence has published a detailed analysis of a new malware campaign linked to North Korean nation-state actors, marking a tactical evolution in how groups like Contagious Interview and Famous Chollima deploy their tools. According to the report, the activity shifted from software developers to broader industries, with lures targeting marketing and trader roles in cryptocurrency and retail sector organisations.

BeaverTail and InvisibleFerret malware variants are now distributed as executables rather than scripts, a change that increases portability and can frustrate detection, according to the analysis. The campaign uses the ClickFix social engineering technique, embedding fake CAPTCHAs and troubleshooting cues on a fake hiring platform to prompt victims to run commands that fetch and install the payloads.

The research notes the operation is still in early stages, with low prevalence in malware sandboxes and a lack of wide distribution to date, suggesting operators are refining their techniques before broader deployment. The report concludes this marks a strategic push to diversify the victim pool and strengthen delivery across cryptocurrency and retail sectors.