North Korean Hackers Use Fake Job Interviews to Deploy PylangGhost and GolangGhost RATs

Gbhackers •Kavichselvan • July 22, 2026

North Korea’s Famous Chollima threat group, also tracked as Wagemole, is actively running a sophisticated cyberespionage campaign dubbed ClickFake Interview. The operation targets cryptocurrency and Web3 professionals, tricking candidates into executing terminal commands that infect their devices with platform-specific Remote Access Trojans (RATs): PylangGhost on Windows and GolangGhost on macOS. Detailed analysis by the SOCRadar […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean ClickFake Campaign Targets Web3 Professionals with RATs Researchers at SOCRadar have identified a new social engineering campaign by North Korea's Famous Chollima group, targeting Web3 and cryptocurrency professionals. The operation, dubbed ClickFake, employs fraudulent job interviews to lure candidates into executing malicious terminal commands. Victims are tricked into installing PylangGhost on Windows and GolangGhost on macOS via highly interactive web portals that simulate recruitment processes. The campaign uses platforms like Telegram and Discord to reach targets, offering lucrative job opportunities to entice them. Once engaged, candidates face psychological pressure through countdown timers and warnings against switching tabs. The attackers utilize advanced techniques to evade detection, including compiling their payloads into native dynamic link libraries. This targeted approach signifies a shift from broad phishing tactics to more personalized scams. The current status of the campaign remains active, with ongoing threats to the cryptocurrency sector. 2 sources 73

Extracted Entities

North Korean Hackers Use Fake Job Interviews to Deploy PylangGhost and GolangGhost RATs

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Campaigns (1)

Countries (1)

Malware (2)

MITRE ATT&CK (1)

Platforms (2)