Related Threat Clusters

NPM Packages Distribute PylangGhost RAT in Supply Chain Attack
Malicious npm packages have been identified as vehicles for the PylangGhost remote access trojan (RAT), linked to North Korean state-sponsored group FAMOUS CHOLLIMA. The attack began with the release of compromised…

4 articles · Updated March 17, 2026
North Korean ClickFake Campaign Targets Web3 Professionals with RATs
Researchers at SOCRadar have identified a new social engineering campaign by North Korea's Famous Chollima group, targeting Web3 and cryptocurrency professionals. The operation, dubbed ClickFake, employs fraudulent job…

2 articles · Updated July 22, 2026

Recent Intelligence Reports

North Korean Hackers Use Fake Job Interviews to Deploy PylangGhost and GolangGhost RATs — Gbhackers · July 22, 2026
Researchers Uncover North Korean 'ClickFake' Campaign Targeting Web3 Pros — Infosecurity-Magazine · July 21, 2026
Malicious npm Packages Deliver PylangGhost RAT in New Software Supply Chain Campaign — Cybersecuritynews · March 17, 2026
Malicious NPM Packages Spread PylangGhost RAT in Supply Chain Attack — Gbhackers · March 17, 2026

Chollima FAMOUS CHOLLIMA WageMole Malware Phishing Supply Chain Attack Trojan ClickFake Interview North Korea GolangGhost Go T1059.001 - PowerShell