North Korean Hackers Target Crypto Workers With Fake Job Interviews And New Malware

A new North Korean hacking campaign is targeting crypto professionals with fake job offers to spread powerful malware. The goal: steal sensitive data and gain remote access to victims’ systems.

The malware, PylangGhost, can grab login info from over 80 browser extensions, including major crypto wallets and password managers. Most victims so far are blockchain developers and crypto workers in India.

Fake Interviews, Real Damage

The attackers pretend to be recruiters from well-known crypto firms like Coinbase, Uniswap, and Robinhood. They contact potential victims through job platforms and email, offering fake positions to lure them in. After some basic back-and-forth, the “recruiters” send links to bogus skill tests hosted on websites made to look legit.

Once a candidate completes the test, hackers ask him to enable their webcam and microphone for a supposed video interview. That’s where things turn dangerous. Hackers tell victims they need to install a video driver update for the interview to work properly. But what they’re really downloading is PylangGhost, a Python-based remote access trojan.

The malware gives hackers full control over the infected machine. It can steal files, track activity, and send login info back to the attackers’ command servers. Passwords, wallet keys, cookies. Everything is up for grabs.

As threats like this grow, more people are starting to use the best decentralized crypto wallets to store their assets offline or in non-custodial systems. These wallets give users full control of their keys, keeping them safer from remote breaches like this one.

New Name, Old Tricks

The hacking group behind this campaign goes by the name “Famous Chollima,” though it’s also famous in cybercrime circles as “Wagemole.” It has ties with other North Korean cyber groups like Lazarus, which has a long history of targeting crypto projects and stealing digital assets, such as the attack on Sony Pictures in 2014.

Cisco Talos, a top security research firm, was the first to identify PylangGhost. According to their report, the malware is a cousin of the earlier GolangGhost trojan. While GolangGhost mainly attacked macOS systems, this new version targets Windows machines.

The tools and methods might be evolving, but the approach isn’t new. North Korean actors have used fake jobs and fake companies to plant malware before. In late 2024, U.S. officials seized a domain linked to a sham business, BlockNovas LLC, which was being used in a similar type of attack. That case also involved fake interviews, phishing emails, and malware-laced documents.

The Scope Keeps Growing

The malware doesn’t just go after browser data. It can take screenshots, manage files, gather system info, and maintain long-term access to the victim’s device. Researchers say this allows the attackers to not only steal money but also collect intelligence on crypto firms and their inner workings.

Scammers could use that information in future attacks or to help place other fake applicants inside real companies. In fact, in May, the crypto exchange Kraken said it caught a North Korean agent applying for a tech job. The operative failed identity checks during the hiring process, but the case showed how far these campaigns can go.

South Korean, Japanese, and U.S. officials have confirmed that North Korean-backed groups stole over $650 million in crypto in just the first half of 2024. Experts say that number could rise sharply as these fake hiring scams keep spreading.

Calls for Stronger Cyber Checks

Security experts say that it is essential to stop these attacks. In India, where many of the latest victims are based, leaders in the tech and security fields are urging action.

Dileep Kumar H V, director at the Digital South Trust, said the government should make cybersecurity audits mandatory for blockchain firms. He also called for better monitoring of fake job sites and stronger coordination with global agencies.

CERT-In, the country’s main cyber agency, has been asked to issue public alerts, while lawmakers have been urged to toughen the IT Act to help prosecutors go after cross-border crimes.

It’s clear that the goal isn’t just theft but access itself. These hackers are trying to break into the crypto space through the people who build and run it. And unless companies and workers stay alert, they’ll find more ways in.

Stay Smart, Stay Safe

The safest defense right now is awareness. Don’t trust random job offers that come out of nowhere. Never install software during an interview, and always double-check the sites you need to visit. As the crypto industry grows, so do the risks around it. 

Disclaimer: Any information written in this press release or sponsored post does not constitute investment advice. Themarketperiodical and all its authors do not, and will not endorse any information on any company or individual on this page. Readers are encouraged to make their own research and make any actions based on their own findings and not from any content written in this press release or sponsored post. Themarketperiodical.com is and will not be responsible for any damage or loss caused directly or indirectly by the use of any content, product, or service mentioned in this press release or sponsored post.