Security researchers at SOCRadar have identified a sophisticated social engineering campaign by North Korean threat actors targeting professionals in the Web3 and cryptocurrency sectors. The operation, attributed to the Famous Chollima group (also tracked as Wagemole), uses fake job recruitment schemes to deliver remote access trojans capable of stealing cryptocurrency wallet credentials and private keys. The attackers initiate contact through professional platforms including LinkedIn, Telegram, Discord, and email, posing as recruiters from legitimate companies or creating entirely fictitious organizations.
The attack chain begins when threat actors offer lucrative positions to developers and administrators, then direct candidates to complete mandatory skill assessments on attacker-controlled web portals. These fraudulent platforms incorporate sophisticated social engineering elements including real-time monitoring, countdown timers, and automated warnings that discourage victims from switching browser tabs during the assessment. The platforms display tailored interview questions based on each candidate's advertised role to establish credibility and maintain the illusion of legitimacy.
The core exploitation technique relies on ClickFix, where the assessment platform artificially generates an error claiming it cannot access the candidate's camera or microphone. To resolve the fabricated issue, victims receive instructions to copy and paste a diagnostic command into their system terminal. On Windows systems, this command triggers PowerShell or curl to download a compressed archive containing a Visual Basic Script that unpacks a Python runtime, ultimately loading PylangGhost RAT. The attackers use Nuitka to compile Python payloads into native dynamic link libraries, evading signature-based detection. For macOS users, the malicious command deploys GolangGhost, a Go-based RAT often accompanied by a SwiftUI credential harvester designed to capture administrative passwords.
Both malware variants feature modular architecture with six interconnected components: a main orchestrator, configuration holder, archive helper, command launcher, command-and-control communications module, and specialized data stealer. The stealer targets more than 80 browser extensions, specifically harvesting session data, saved credentials, and private keys from cryptocurrency wallets including MetaMask, Phantom, and TronLink, as well as password managers like NordPass. Because many Web3 professionals manage corporate infrastructure through browser-based tools, successful compromises can provide access to millions in digital assets.
Organizations should implement strict policies prohibiting personal job searches on corporate devices, as SOCRadar notes that one in three employees admit to using company technology for job applications and interviews. Security teams should monitor for suspicious terminal commands, block newly registered domains from budget registrars like Hostinger and NameCheap, and educate employees about recruitment-based social engineering tactics. Web3 professionals should verify recruiter identities through official company channels, avoid executing terminal commands during interviews, and maintain separate devices for job searches and cryptocurrency management.
Source: https://www.infosecurity-magazine.com/news/north-korean-clickfake-campaign/