North Korean Hackers Deploying PylangGhost Trojan to Target Crypto Experts, Stealing Wallets and Passwords via Fake Recruitment Sites
A sophisticated new cyber attack campaign, allegedly carried out by the North Korean hacker group, is targeting experts in the cryptocurrency and blockchain field. The main tool of this campaign is a remote access trojan called "PylangGhost", specifically designed to steal sensitive information from crypto wallets and password managers.
According to a report from Cisco Talos published on Wednesday, the hacker group behind the incident is identified as "Famous Chollima", also known as "Wagemole". PylangGhost is an upgraded version of the previously discovered GolangGhost RAT, built using the Python programming language with enhanced system infiltration and data theft capabilities.
The attack campaign primarily targets crypto experts in India – a country experiencing strong growth in the blockchain field. Notably, Famous Chollima's main method is using social engineering with fake recruitment scenarios. The group creates websites impersonating major fintech companies like Coinbase, Robinhood, and Uniswap to approach job seekers.
When victims are contacted by fake "recruiters", they are invited to participate in online skill tests on these fake recruitment websites. During the interview, victims are persuaded to grant access to their device's camera and video, and are instructed to copy and execute a malicious code – disguised as a necessary step to install a new video driver.
Once the victim activates the malicious code, PylangGhost is installed on the device, giving hackers complete system control. The malware's payload is designed to extract cookies and login information from over 80 web browser extensions, particularly popular crypto wallets like MetaMask, Phantom, and password managers like 1Password.
Using fake recruitment tactics to attack is not new, but always proves highly effective in exploiting human factors to bypass technical defenses. Previously, in April, another hacker group involved in the $1.4 billion theft from Bybit was discovered using a similar method to trick crypto developers into performing fake recruitment tests with embedded malicious code.
The emergence of PylangGhost and this latest campaign demonstrates that North Korean hackers are continuously developing and refining attack tools targeting high-value targets in the digital finance sector.
