Fake Crypto Job Interview Used to Spread 'PylangGhost' Malware

The group, known as Famous Chollima (also referred to as Wagemole), has been using fake interviews to spread malware called "PylangGhost".

This remote access trojan (RAT), built in Python, is based on an older malware strain called GolangGhost.

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

What are dApps in Crypto? (Explained with Animations)

SUBSCRIBE

ON YOUTUBE

The campaign mainly targets job seekers in India with experience in cryptocurrency. Victims are contacted by fake recruiters posing as representatives of companies, such as Coinbase $808.88M , Uniswap $120.3M , or Robinhood.

Hackers guide the targets through a fake hiring process, which starts with messages and links to job testing sites that appear genuine. After collecting basic information, they invite candidates to a video call that looks like a real interview.

During the call, they ask the victim to enable camera and microphone access and to run certain computer commands. They claim this is needed to install or update video drivers, but instead, it installs the PylangGhost malware.

Once the malware is active, it gives hackers remote access to the person’s computer. It can collect system information, take screenshots, move files, and stay connected to the machine.

Cisco Talos stated that the malware is used to steal login details from over 80 browser extensions, including MetaMask, Phantom, TronLink, 1Password, NordPass, Bitski, Initia, and MultiverseX. Many of these are used to manage cryptocurrency wallets.

Meanwhile, Mobile Threat Intelligence reported that Crocodilus, an Android malware, has become more dangerous due to recent updates. What can it do? Read the full story.