
North Korean crypto malware hidden in fake job sites is targeting industry workers to steal wallets and gain remote access.
Author: Akshat Thakur
A DPRK-linked group is using fake job sites and Python-based malware to target blockchain professionals for credential theft.
Crypto professionals are once again in the crosshairs of North Korean hackers. This time, attackers are hiding malware in fake job application processes to steal wallet credentials and gain remote access to victims’ systems.
Researchers at Cisco Talos uncovered the campaign this week, identifying the new malware as PylangGhost, a Python-based remote access trojan (RAT). This RAT is a variant of GolangGhost, which was previously used by the same hacking group.
The attackers impersonate top crypto firms like Coinbase, Robinhood, and Uniswap. They direct victims to fake career websites and lure them into staged “skill tests.”
After completing the test, targets are asked to paste a command into their terminal. This step downloads a ZIP file containing the malware disguised as a video driver update.
The payload includes:
nvidia.py)Once installed, PylangGhost can:
The malware also performs:
Unlike earlier versions, this variant was written in Python to target Windows systems. Mac users are still vulnerable to the Golang version. Linux remains largely unaffected.
The campaign is linked to Famous Chollima, a known DPRK-aligned group active since mid-2024. Most of the recent victims appear to be based in India and have blockchain work experience.
Their tactic is simple but effective: impersonate well-known crypto companies and trick candidates into running malicious commands.
Our Crypto Talk is committed to unbiased, transparent, and true reporting to the best of our knowledge. This news article aims to provide accurate information in a timely manner. However, we advise the readers to verify facts independently and consult a professional before making any decisions based on the content since our sources could be wrong too. Check our Terms and conditions for more info.
SMCI Co Founder Arrested Smuggling $2.5B Nvidia GPUs To China
TRUST Staking Vault Exploit Drains 85M Tokens on Base
Venus Protocol Exploit Triggers Bad Debt After Token Manipulation
Morphware AI Scam Allegations Surface After $XMW Rug Pull Allegations
SMCI Co Founder Arrested Smuggling $2.5B Nvidia GPUs To China
TRUST Staking Vault Exploit Drains 85M Tokens on Base
Venus Protocol Exploit Triggers Bad Debt After Token Manipulation
Morphware AI Scam Allegations Surface After $XMW Rug Pull Allegations