Researchers at Cisco Talos have uncovered a North Korean hacking group targeting cryptocurrency workers with a Python-based malware disguised as part of a fake job application process. The majority of the victims appear to be based in India and have prior experience in blockchain and cryptocurrency startups. Although there is no evidence of internal compromise, the risk remains that these efforts are attempting to gain access to the companies these individuals may eventually join. The malware, known as PylangGhost, is a new variant of the previously documented GolangGhost remote access trojan, rewritten in Python to target Windows systems more effectively.

Mac users are still affected by the Golang version, while Linux systems seem to be unaffected. The threat actor behind the campaign, known as Famous Chollima, has been active since mid-2024 and is believed to be a DPRK-aligned group. Their latest attack vector involves impersonating top crypto firms like Coinbase, Robinhood, and Uniswap through highly polished fake career sites, luring software engineers, marketers, and designers into completing staged 'skill tests.' Once a target fills in basic information and answers technical questions, they are prompted to install fake video drivers by pasting a command into their terminal, which quietly downloads and launches the Python-based RAT. The payload is hidden in a ZIP file that includes the renamed Python interpreter, a Visual Basic script to unpack the archive, and six core modules responsible for persistence, system fingerprinting, file transfer, remote shell access, and browser data theft.

The RAT pulls login credentials, session cookies, and wallet data from over 80 extensions, including MetaMask, Phantom, TronLink, and 1Password. The command set allows full remote control of infected machines, including file uploads, downloads, system recon, and launching a shell, all routed through RC4-encrypted HTTP packets. Despite being a rewrite, the structure and naming conventions of PylangGhost mirror those of GolangGhost almost exactly, suggesting both were likely authored by the same operator, according to Cisco.