# GolangGhost/PylangGhost RAT Targets Web3 Job Seekers to Steal Chrome Credentials and MetaMask Data (Famous Chollima / ClickFake Interview)

> North Korea-aligned Famous Chollima (Wagemole) is running a fake-recruitment 'ClickFake Interview' campaign against cryptocurrency and Web3 professionals, using a staged camera/microphone-fix ClickFix lure to get victims to paste a malicious Terminal/PowerShell command. This deploys GolangGhost (macOS, Go) or PylangGhost (Windows, Python), which abuses the macOS Keychain and Chrome's local databases to steal credentials/cookies from 80+ browser extensions, specifically hijacking MetaMask by rewriting Chrome's Secure Preferences to grant it expanded permissions.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1610
- **ID:** TL-2026-1610
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** WageMole (North Korea)
- **Detections:** 9 · **IOCs:** 42 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Famous Chollima (also tracked as Wagemole, a North Korean Reconnaissance General Bureau-linked cluster overlapping with Lazarus Group's broader fake-recruiter operations) runs a multi-stage social-engineering campaign dubbed 'ClickFake Interview.' Fake recruiter personas contact cryptocurrency, blockchain, and Web3 professionals (roles spanning investment, legal, advisory, business development, and engineering with direct wallet or company account access) via LinkedIn and similar platforms, directing them to React-based skill-assessment sites impersonating real companies such as Coinbase, Robinhood, Uniswap, Kraken, and Parallel Studios (Doodles). After candidates complete a coding/skill quiz, the site presents a fabricated camera or microphone driver error and instructs the victim to 'fix' it by copy-pasting an OS-specific command into a terminal (a ClickFix-style social-engineering technique).

On Windows, the command uses PowerShell Invoke-WebRequest or curl to fetch a ZIP archive containing PylangGhost modules and a Visual Basic Script; the VBScript extracts lib.zip and launches a renamed Python interpreter executing nvidia.py as the RAT's main module, then installs a Registry Run key for persistence across logons. On macOS, an equivalent Bash one-liner downloads a fake 'Intel/NVIDIA driver' ZIP (CodeFixerNow.app / macPatch.sh) containing the Go-compiled GolangGhost binary, and establishes persistence via a Launch Agent plist so the RAT restarts on reboot.

Both variants share near-identical module structure and a compact single-letter/short-code command set (qwer/asdf/zxcv/vbcx/ghdj/r4ys/89io/gi%#/dghh) implementing system-info collection, file upload/download, remote shell, sleep, and staged browser-credential theft. Chrome credential and cookie databases are decrypted using the OS's native credential store (macOS Keychain via the `security` utility on macOS; DPAPI-protected local state on Windows) and exfiltrated to the C2. The RAT enumerates and harvests session/credential data from over 80 browser extensions, explicitly including cryptocurrency wallets (MetaMask, Phantom, Bitski, Initia, TronLink, MultiverseX) and password managers (1Password, NordPass). Uniquely, the malware force-closes Chrome, then rewrites the browser's Secure Preferences file to inject expanded permissions (active-tab access, clipboard write, arbitrary web requests, expanded storage access) directly into the installed MetaMask extension, abusing the wallet's trusted browser-extension position to enable follow-on transaction manipulation or session hijacking without needing to re-authenticate.

C2 communications use HTTP (unencrypted transport) carrying RC4-encrypted payloads, each packet prefixed with a 16-byte MD5 integrity checksum and a 128-byte embedded RC4 key, maintained through a persistent command loop. Infrastructure is disposable and rotated frequently: dozens of typosquatted/fake driver-update and skill-assessment domains front a small pool of VPS-hosted C2 IPs on port 8080. Cisco Talos first documented GolangGhost/the ClickFake Interview campaign in 2025 and later identified the Python-based PylangGhost variant, noting near-identical module design between the two implementations indicative of a shared development team. Reported impact has so far been limited and concentrated among individuals in India, with no confirmed Cisco enterprise customer compromises via telemetry, though the campaign continues to evolve with new infrastructure and lure domains as of the July 2026 reporting.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1593.001 Social Media
- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1608.001 Upload Malware
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1059.006 Python
- T1059.005 Visual Basic
- T1547.001 Registry Run Keys / Startup Folder
- T1647 Plist File Modification
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1555.003 Credentials from Web Browsers
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1083 File and Directory Discovery
- T1115 Clipboard Data
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [GolangGhost Malware Steals Chrome Secrets](https://cybersecuritynews.com/golangghost-steals-chrome-secrets/)
- [Famous Chollima deploying Python version of GolangGhost RAT](https://blog.talosintelligence.com/python-version-of-golangghost-rat/)
- [Chollima Hackers Target Windows and MacOS with New GolangGhost RAT Malware](https://gbhackers.com/chollima-hackers-target-windows-and-macos/)
- [GolangGhost RAT: Chollima Hackers Strike Both Windows and MacOS Systems](https://cyberpress.org/chollima-hackers-strike-both-windows-and-macos-systems/)
- [Famous Chollima's PylangGhost](https://blog.polyswarm.io/famous-chollimas-pylangghost)
- [Chollima's Python Trap: PyLangGhost RAT Haunts Crypto & Finance](https://www.esentry.io/articles/chollimas-python-trap-pylangghost-rat-haunts-crypto-finance)
- [North Korean Hackers Deploy Python-Based Trojan Targeting Crypto](https://www.infosecurity-magazine.com/news/north-korean-hackers-python-trojan/)
- [PyLangGhost RAT: Rising Data Stealer from Lazarus Group Targeting Finance and Technology](https://medium.com/@anyrun/pylangghost-rat-rising-data-stealer-from-lazarus-group-targeting-finance-and-technology-d65cf790fb6d)
- [DPRK's Famous Chollima Deploys RATs Through ClickFake Job Interviews](https://socradar.io/blog/dprk-clickfake-pylangghost-golangghost-rats/)
- [GolangGhost RAT (Mac) - Removal steps, and macOS cleanup](https://www.pcrisk.com/removal-guides/33195-golangghost-rat-mac)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1610