North Korean Hackers Use Fake Job Sites to Steal Crypto Wallets – Here’s How

by

Well, well, well, North Korean hackers are back at it again, this time using a Python-based malware called PylangGhost to ruin your day. Apparently, they’ve got a new hobby: targeting crypto job seekers. So, if you were planning to land your dream gig in the digital coin world, maybe hold off on that “I’m so ready to be scammed” vibe.

According to Cisco Talos (aka the good guys with all the scary tech knowledge), this shiny new malware is straight out of the hacker group Famous Chollima’s playbook. They’ve been busy creating fake job sites to trick you into handing over your life’s work – AKA passwords, crypto wallets, and sensitive info. Real professional, right?

Now, if the name PylangGhost sounds familiar, it might be because it’s a Python-based remote access trojan (aka RAT – the real rats of the internet). It’s essentially the less glamorous cousin of the GolangGhost RAT, which Cisco Talos unearthed last December. But, like most great villains, they’re mixing it up, so it’s harder for you to tell who’s coming for your data next.

The hackers are also a little cheeky, targeting unsuspecting Windows users while still rocking a Golang-based malware version for MacOS users. Spoiler alert: The majority of victims? India. Yep, it’s global, people.

But here’s the kicker: The Famous Chollima crew has a nickname. You can call them “Wagemole.” Yep, Wagemole – like, “Let’s get those passwords and crypto wallets while pretending to be your dream job.” Classic.

How Do North Korean Hackers Reel in Their Victims?

So, how exactly do these digital mischief-makers lure their prey? According to Cisco, the hackers are slick. They create fake job interview campaigns. Oh, it’s all legit-looking too – fake job sites that mimic the biggest names in crypto, like Coinbase, Robinhood, and Uniswap. It’s like they’ve been studying your resume for a while.

The next step? The victims get invited to “interviews,” where they’re asked to visit these fraudulent sites and take fake skill tests. Sure, sounds normal, right? But plot twist: as the scam goes on, the “recruiters” ask for permissions to access cameras and microphones. How lovely.

Then, the magic happens. The “recruiters” convince their victims to run some sketchy commands under the guise of “updating video drivers.” And bam – PylangGhost takes over. It remotely controls your device, steals cookies, and grabs credentials from more than 80 browser extensions.

And don’t think your precious crypto wallet is safe. They get access to all the good stuff: password managers, MetaMask, 1Password, NordPass, and more. Basically, they’re taking your secrets and probably laughing about it in their hacker lair.

Remember, this isn’t just a one-off thing. Another North Korean group, Lazarus, is also using similar tactics, with fake job applications and malware galore. Because why settle for one scam when you can have three, right?

Read More

2025-06-20 09:42