A new sophisticated social engineering operation targeting Web3 and cryptocurrency professionals has been identified by researchers at SOCRadar.

Attributed to the notorious North Korean-aligned hacking group Famous Chollima, also known as Wagemole, the campaign leverages fraudulent job interviews and highly interactive web portals to trick candidates into installing remote access trojans (RATs) on their personal devices.

Instead of relying on broad phishing blasts, researchers at SOCRadar Threat Research Unit (STRU) noted that the threat group is shifting to highly personalized recruitment scams that capitalize on the high mobility of tech talent in the cryptocurrency market.

By manufacturing elaborate pretexts, Famous Chollima establishes a high degree of trust with its targets before launching the decisive blow.

Leveraging ClickFix Lures Within Broader Recruiter Schemes

The attack begins on mainstream professional networks and communication platforms, including LinkedIn, Telegram, Discord and direct email.

Posing as recruiters from reputable firms or creating entirely fictitious web companies, the actors reach out to developers and administrators. They entice these candidates with highly lucrative salary packages and prestigious career advancements, successfully guiding them toward the next phase of the process, which is a mandatory skill assessment test.

Once the target agrees to the assessment, they are directed to a specialized online platform controlled by the attackers. These malicious web interfaces utilize real-time monitoring and psychometrics to build authenticity. They feature strict gating mechanisms, display tailored interview questions based on the candidate's advertised role and incorporate countdown timers to create psychological pressure.

The platforms also issue automated warnings if the user attempts to switch browser tabs, which successfully deters candidates from researching the suspicious behavior of the page.

The core of the deception lies in a technique known as ClickFix. While the candidate is performing the assessment, the platform artificially triggers a simulated error, claiming that the system cannot access the user's camera or microphone.

Read more: What is ClickFix and How to Prevent It

To resolve the issue and continue with the interview, the page displays a helpful prompt instructing the candidate to copy and paste a diagnostic command into their system terminal.

By capitalizing on the target's desire to perform well against the clock, the attackers successfully bypass traditional security warnings.

The Windows Vector and PylangGhost

If the victim is running a Windows operating system, executing the copied command initiates a complex infection chain. The script utilizes native system utilities like PowerShell or curl to fetch a compressed ZIP archive from the attacker's server.

It then leverages a Visual Basic Script to silently unpack a Python runtime. This environment is used to run an execution wrapper that ultimately loads PylangGhost, a highly customized RAT.

To maximize evasion, the actors compile their Python payloads into native dynamic link libraries using Nuitka, preventing signature-based security tools from easily identifying the threat.

The macOS Vector and GolangGhost

For macOS users, the attack path is similarly streamlined but the toolset is built around different programming language. The malicious terminal command fetches and executes GolangGhost, a remote access trojan written in Go.

On Apple devices, the infection process often installs the primary payload alongside a credential-harvesting helper application built with SwiftUI, which is specifically designed to trick macOS users into surrendering their administrative passwords.

Modular Stealers Built for Maximum Impact

Both PylangGhost and GolangGhost are built on a highly modular architecture consisting of six interconnected parts.

These components include a main orchestrator, a dedicated configuration holder, an archive helper, a command launcher, a command-and-control (C2) communications module and a specialized data stealer.

By dividing functionality across these distinct modules, the malware can seamlessly execute commands, manage persistence and dynamically load new capabilities based on instructions received from the attacker's server.

The primary objective of this dual-headed malware suite is financial gain through asset theft.

The integrated stealer module targets more than 80 distinct browser extensions. It is specifically programmed to harvest session data, saved credentials and private keys from widely used cryptocurrency wallets such as MetaMask, Phantom and TronLink, as well as commercial password managers like NordPass.

Because many Web3 professionals manage corporate infrastructure using browser-based tools, a single successful intrusion can grant attackers access to millions of dollars in digital assets.

To keep their operations running, Famous Chollima rapidly register domains using budget-friendly registrars like Hostinger and NameCheap.

Rather than focusing on long-term infrastructure resilience, they prioritize speed and sheer volume, spinning up new assessment portals as quickly as defenders can blacklist the old ones.

They also implement precise targeting controls, such as blocking mobile devices and validating individual invitation links, to prevent automated malware sandboxes and security analysts from studying their payload delivery mechanisms.

In a July 20 report on this new ‘ClickFake Interview’ campaign, the STRU researchers noted that this campaign is not only a risk to individuals.

“The actors also seek indirect access to pivot toward company funds, which makes it equally alarming for organizations, since recent reports state that ‘one in three employees admit to using company tech to apply for jobs, interview, or do work for other companies,’” they wrote.