Cybersecurity researchers at SOCRadar have identified a new social engineering campaign, dubbed "ClickFake Interview," targeting Web3 and cryptocurrency professionals. The operation is attributed to the North Korean-aligned hacking group Famous Chollima, also known as Wagemole, and aims to install remote access trojans (RATs) on victims' devices through elaborate fake job interviews.
Unlike previous broad phishing attempts, this campaign employs highly personalized recruitment scams. The attackers initiate contact on professional networks like LinkedIn, Telegram, Discord, and via direct email, posing as recruiters from legitimate companies or creating fictitious firms. They entice targets with attractive salary packages and career advancements, leading them to a mandatory skill assessment.
Candidates are then directed to sophisticated online assessment platforms controlled by the attackers. These platforms are designed to appear authentic, featuring real-time monitoring, tailored interview questions, and countdown timers to create psychological pressure. They also issue warnings if users attempt to switch browser tabs, deterring investigation.
The core of the deception, termed "ClickFix," occurs during the assessment. The platform simulates an error, claiming it cannot access the user's camera or microphone. To resolve this, the victim is prompted to copy and paste a diagnostic command into their system terminal. This tactic leverages the candidate's desire to perform well under time pressure, bypassing typical security warnings.
For Windows users, executing the command triggers a complex infection chain. It uses native utilities like PowerShell or curl to download a ZIP archive. A Visual Basic Script then silently unpacks a Python runtime environment, which loads an execution wrapper for PylangGhost, a highly customized RAT. To avoid detection, Python payloads are compiled into native dynamic link libraries using Nuitka.
macOS users face a similar but distinct attack path. The malicious terminal command fetches and executes GolangGhost, a RAT written in Go. On Apple devices, the infection process often includes a SwiftUI-built credential-harvesting helper application designed to trick users into providing administrative passwords.
Both PylangGhost and GolangGhost are modular, comprising six interconnected components: an orchestrator, a configuration holder, an archive helper, a command launcher, a command-and-control (C2) communications module, and a specialized data stealer. This modular design allows for seamless command execution, persistence management, and dynamic loading of new capabilities.
The primary goal of this malware suite is financial gain through asset theft. The integrated stealer module targets over 80 browser extensions, specifically designed to harvest session data, saved credentials, and private keys from popular cryptocurrency wallets like MetaMask, Phantom, and TronLink, as well as password managers such as NordPass. Given that many Web3 professionals manage corporate infrastructure via browser-based tools, a single successful intrusion could provide access to substantial digital assets.
Famous Chollima rapidly registers domains using budget-friendly registrars like Hostinger and NameCheap, prioritizing speed and volume over long-term infrastructure resilience. They quickly establish new assessment portals as old ones are blacklisted. The group also implements precise targeting controls, such as blocking mobile devices and validating individual invitation links, to prevent automated malware sandboxes and security analysts from studying their payload delivery mechanisms.
Researchers emphasize that this campaign poses a risk not only to individuals but also to organizations, as attackers seek indirect access to company funds. This is particularly concerning given that recent reports indicate a significant number of employees use company technology for job applications and interviews.
