Threats Tagged 'golangghost'

The Contagious Trader campaign is a sophisticated malware operation targeting cryptocurrency users, attributed to North Korea with high confidence. It involves malicious cryptocurrency trading bot projects on GitHub that exfiltrate sensitive data and private keys using various techniques, including malicious npm dependencies. The campaign demonstrates overlaps with known North Korean tactics, particularly those of FAMOUS CHOLLIMA, including the use of GitHub, npm, and Vercel infrastructure, Base64-encoded payload URLs, and anonymizing VPNs for npm package publishing. The operation represents a shift in tactics, expanding beyond the previous Contagious Interview campaign to target a broader range of cryptocurrency users.

MediumMalwareUnited StatesSouth KoreaJapan+7#pylangghost#invisibleferrett#bigsquatrat

PurpleBravo, a North Korean state-sponsored threat group, targets software developers through fake recruitment efforts, particularly in cryptocurrency and software development sectors. Their toolkit includes BeaverTail, PyLangGhost, and GolangGhost, designed for stealing browser credentials and cryptocurrency information. The group has affected 3,136 IP addresses, mainly in South Asia and North America, compromising 20 organizations across various industries. PurpleBravo's tactics include using fictitious personas, malicious GitHub repositories, and sophisticated malware to infiltrate IT services companies, posing a significant supply-chain risk. The group shows overlap with PurpleDelta, another North Korean threat actor, sharing infrastructure and operational patterns. PurpleBravo's focus on the IT sector in South Asia presents an overlooked threat to organizations outsourcing IT services.

MediumCampaignUnited KingdomGermanyFrance+5#cryptocurrency#it services#social engineering

WaterPlum, a North Korean-associated attack group, has been using a new malware called OtterCandy in their ClickFake Interview campaign. OtterCandy, implemented in Node.js, combines features of RATatouille and OtterCookie. It targets Windows, macOS, and Linux systems, stealing browser credentials, cryptocurrency wallets, and confidential files. The malware communicates with C2 servers via Socket.IO and has persistence mechanisms. An August 2025 update (v2) enhanced user identification, expanded theft targets, and added trace deletion capabilities. OtterCandy's evolution and its use in ongoing campaigns highlight the need for continued vigilance against WaterPlum's activities.

MediumMalwareGermanyUnited KingdomFrance+3#ratatouille#info stealer#ottercandy

Famous Chollima, a North Korean threat group, has deployed a new malware campaign targeting job seekers by impersonating hiring organizations. The attack involves a trojanized Node.js application named 'Chessfi' and uses evolving malware tools BeaverTail and OtterCookie, which now include keylogging and screenshot capabilities. A malicious Visual Studio Code extension embedding these tools was also discovered, indicating new infection vectors. The malware steals cryptocurrency credentials by targeting multiple browsers and wallet extensions, and it can upload files from compromised systems. This campaign leverages social engineering and developer tools to infiltrate victims, focusing on cryptocurrency theft and credential harvesting. The threat is medium severity due to its broad capabilities and stealth but requires user interaction for infection. European organizations involved in software development, cryptocurrency, and job recruitment are at particular risk.

MediumMalwareGermanyFranceNetherlands+4#vs code extension#beavertail#north korea

In May 2025, Cisco Talos identified a Python-based remote access trojan (RAT) called 'PylangGhost', used by a North Korean-aligned threat actor. PylangGhost shares similarities with the previously documented GolangGhost RAT. The threat actor, Famous Chollima, has been targeting employees with experience in cryptocurrency and blockchain technologies through fake job interview sites. The attacks primarily affect users in India. The malware is deployed through a two-stage process involving fake skill-testing pages and malicious command execution. PylangGhost consists of six Python modules and offers functionalities similar to its Golang counterpart, including system information collection, file manipulation, and browser data theft from over 80 extensions.

MediumCampaignGermanyUnited KingdomFrance+3#blockchain#cryptocurrency#browser data theft