Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers

Part of the WageMole story · since 16 Oct 2025

Developinglatest 2 hours ago21 articles9 outlets
16 Oct · GBHackers first23 Apr26 Jun29 AugNowThis article14th of 21
  • Thu 16 Oct, 13:40 UTC. GBHackers, first report. North Korean Hackers Deploy BeaverTail–OtterCookie Combo for Keylogging Attacks.
  • Fri 17 Oct, 01:45 UTC. SecurityOnline, its first report on the story. North Korea’s Famous Chollima APT Uses Trojanized Node.js App to Deploy OtterCookie RAT for Crypto Theft.
  • Fri 17 Oct, 13:00 UTC. GBHackers. ClickFake Interview Campaign Used by Threat Actors to Deliver OtterCandy Malware.
  • Mon 20 Oct, 00:55 UTC. SecurityOnline. North Korea’s WaterPlum APT Deploys Node.js OtterCandy RAT for Crypto Theft with Anti-Forensic Module.
  • Wed 21 Jan, 18:30 UTC. The Hacker News, its first report on the story. North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses via Fake Job Interviews.
  • Tue 27 Jan, 00:50 UTC. SecurityOnline. “Contagious Interview”: How North Korean Hackers Use Fake Jobs to Breach IT Firms.
  • Mon 23 Mar, 20:21 UTC. The Hacker News. North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware.
  • Tue 21 Apr, 09:51 UTC. trendmicro.com, its first report on the story. Void Dokkaebi Turns Repos Into Worm Like Supply Chain Attack.
  • Wed 22 Apr, 15:08 UTC. Dark Reading, its first report on the story. North Korean Fake Job Scam Triggers Contagious Interview Malware.
  • Wed 29 Apr, 14:21 UTC. Infosecurity, its first report on the story. Malicious npm Dependency Linked to AI Assisted Commit Targets Crypto Wallets.
  • Wed 29 Apr, 15:31 UTC. The Hacker News. North Korean Hackers Use Supply Chain npm SDK to Steal Secrets.
  • Mon 15 Jun, 19:50 UTC. The Hacker News. North Korean hackers weaponise developer tools to spread malware.
  • Tue 21 Jul, 09:50 UTC. Infosecurity. North Korean hackers use fake crypto job offers to install RATs.
  • Tue 28 Jul, 07:21 UTC. SecurityOnline. Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers. This article, 14th of 21.
  • Mon 7 Sep, 11:26 UTC. Infosecurity. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Tue 22 Sep, 07:47 UTC. Security Affairs, its first report on the story. North Korean Fake Job Interviews Infect 30,000 Devices Worldwide.
  • Tue 22 Sep, 08:59 UTC. SecurityWeek, its first report on the story. North Korean Fake Jobs Infected 30,000 Devices and Stole $10.7m.
  • Tue 22 Sep, 14:31 UTC. Infosecurity. North Korean Hackers Infected 30,000 Devices Through Fake Jobs.
  • Wed 23 Sep, 08:11 UTC. SecurityOnline. North Korean Recruiters Target Developers With Malware in Interviews.
  • Fri 25 Sep, 15:54 UTC. Dark Reading. Nisos Exposes North Korean Fake IT Workers in 170,000 Job Bids.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.

The ClickFake Interview campaign, attributed to the North Korean group Famous Chollima, targets crypto professionals through social engineering tactics. Attackers pose as recruiters on platforms like LinkedIn and email, inviting targets to fake skill assessments that install remote access trojans (RATs) such as PylangGhost and GolangGhost. These payloads gather personal data and seek to steal sensitive information from digital wallets and password managers.

With an estimated $643 million in crypto theft by DPRK this year, the campaign emphasizes urgency and deception to compromise victims. Companies are at risk as employees may inadvertently expose corporate systems. To enhance protection, individuals should verify job offers independently and refrain from using corporate devices for personal job searches.

How the story developed

All 21 articles
Developinglatest 2 hours ago21 articles9 outlets

21 articles from 9 outlets since 16 Oct. Picked up again today after 5 weeks quiet. This was the 14th report, 285 days after the first.

Now16 Oct18 Jan199281862515321827175First reportGBHackers · 16 Oct, 13:40This article14th of 21 · day 285
  • Thu 16 Oct, 13:40 UTC. GBHackers, first report. North Korean Hackers Deploy BeaverTail–OtterCookie Combo for Keylogging Attacks.
  • Fri 17 Oct, 01:45 UTC. SecurityOnline, its first report on the story. North Korea’s Famous Chollima APT Uses Trojanized Node.js App to Deploy OtterCookie RAT for Crypto Theft.
  • Fri 17 Oct, 13:00 UTC. GBHackers. ClickFake Interview Campaign Used by Threat Actors to Deliver OtterCandy Malware.
  • Mon 20 Oct, 00:55 UTC. SecurityOnline. North Korea’s WaterPlum APT Deploys Node.js OtterCandy RAT for Crypto Theft with Anti-Forensic Module.
  • Wed 21 Jan, 18:30 UTC. The Hacker News, its first report on the story. North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses via Fake Job Interviews.
  • Tue 27 Jan, 00:50 UTC. SecurityOnline. “Contagious Interview”: How North Korean Hackers Use Fake Jobs to Breach IT Firms.
  • Mon 23 Mar, 20:21 UTC. The Hacker News. North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware.
  • Tue 21 Apr, 09:51 UTC. trendmicro.com, its first report on the story. Void Dokkaebi Turns Repos Into Worm Like Supply Chain Attack.
  • Wed 22 Apr, 15:08 UTC. Dark Reading, its first report on the story. North Korean Fake Job Scam Triggers Contagious Interview Malware.
  • Wed 29 Apr, 14:21 UTC. Infosecurity, its first report on the story. Malicious npm Dependency Linked to AI Assisted Commit Targets Crypto Wallets.
  • Wed 29 Apr, 15:31 UTC. The Hacker News. North Korean Hackers Use Supply Chain npm SDK to Steal Secrets.
  • Mon 15 Jun, 19:50 UTC. The Hacker News. North Korean hackers weaponise developer tools to spread malware.
  • Tue 21 Jul, 09:50 UTC. Infosecurity. North Korean hackers use fake crypto job offers to install RATs.
  • Tue 28 Jul, 07:21 UTC. SecurityOnline. Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers. This article, 14th of 21.
  • Mon 7 Sep, 11:26 UTC. Infosecurity. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Tue 22 Sep, 07:47 UTC. Security Affairs, its first report on the story. North Korean Fake Job Interviews Infect 30,000 Devices Worldwide.
  • Tue 22 Sep, 08:59 UTC. SecurityWeek, its first report on the story. North Korean Fake Jobs Infected 30,000 Devices and Stole $10.7m.
  • Tue 22 Sep, 14:31 UTC. Infosecurity. North Korean Hackers Infected 30,000 Devices Through Fake Jobs.
  • Wed 23 Sep, 08:11 UTC. SecurityOnline. North Korean Recruiters Target Developers With Malware in Interviews.
  • Fri 25 Sep, 15:54 UTC. Dark Reading. Nisos Exposes North Korean Fake IT Workers in 170,000 Job Bids.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 21 articles as a list
  1. Thu 16 OctDay 01
    1. North Korean Hackers Deploy BeaverTail–OtterCookie Combo for Keylogging Attacks13:40 · GBHackers · First report
  2. Fri 17 OctDay 12
    1. North Korea’s Famous Chollima APT Uses Trojanized Node.js App to Deploy OtterCookie RAT for Crypto Theft01:45 · SecurityOnline
    2. ClickFake Interview Campaign Used by Threat Actors to Deliver OtterCandy Malware13:00 · GBHackers

  3. Quiet for 2 days

    Mon 20 OctDay 41
    1. North Korea’s WaterPlum APT Deploys Node.js OtterCandy RAT for Crypto Theft with Anti-Forensic Module00:55 · SecurityOnline · Picked up again

  4. Quiet for 13 weeks

    Wed 21 JanDay 971
    1. North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses via Fake Job Interviews18:30 · The Hacker News · Picked up again

  5. Quiet for 5 days

    Tue 27 JanDay 1031
    1. “Contagious Interview”: How North Korean Hackers Use Fake Jobs to Breach IT Firms00:50 · SecurityOnline · Picked up again

  6. Quiet for 8 weeks

    Mon 23 MarDay 1581
    1. North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware20:21 · The Hacker News · Picked up again

  7. Quiet for 4 weeks

    Tue 21 AprDay 1871
    1. Void Dokkaebi Turns Repos Into Worm Like Supply Chain Attack09:51 · trendmicro.com · Picked up again
  8. Wed 22 AprDay 1881
    1. North Korean Fake Job Scam Triggers Contagious Interview Malware15:08 · Dark Reading

  9. Quiet for 7 days

    Wed 29 AprDay 1952
    1. Malicious npm Dependency Linked to AI Assisted Commit Targets Crypto Wallets14:21 · Infosecurity · Picked up again
    2. North Korean Hackers Use Supply Chain npm SDK to Steal Secrets15:31 · The Hacker News

  10. Quiet for 7 weeks

    Mon 15 JunDay 2421
    1. North Korean hackers weaponise developer tools to spread malware19:50 · The Hacker News · Picked up again

  11. Quiet for 5 weeks

    Tue 21 JulDay 2781
    1. North Korean hackers use fake crypto job offers to install RATs09:50 · Infosecurity · Picked up again

  12. Quiet for 7 days

    Tue 28 JulDay 2851
    1. Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers07:21 · SecurityOnline · Picked up again · This article, 14th of 21

  13. Quiet for 6 weeks

    Mon 7 SepDay 3261
    1. Researchers Map Lazarus Into Six North Korean Cyber Units11:26 · Infosecurity · Picked up again

  14. Quiet for 2 weeks

    Tue 22 SepDay 3413
    1. North Korean Fake Job Interviews Infect 30,000 Devices Worldwide07:47 · Security Affairs · Picked up again
    2. North Korean Fake Jobs Infected 30,000 Devices and Stole $10.7m08:59 · SecurityWeek
    3. North Korean Hackers Infected 30,000 Devices Through Fake Jobs14:31 · Infosecurity
  15. Wed 23 SepDay 3421
    1. North Korean Recruiters Target Developers With Malware in Interviews08:11 · SecurityOnline

  16. Quiet for 2 days

    Fri 25 SepDay 3441
    1. Nisos Exposes North Korean Fake IT Workers in 170,000 Job Bids15:54 · Dark Reading · Picked up again

  17. Quiet for 5 weeks

    Thu 29 OctDay 3781
    1. Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in