Dateline: July 22, 2026
The Job Offer Was Fake. The Malware Was Real.
A recruiter messages you on LinkedIn. The role pays well. The company sounds legitimate. You take the skill assessment, answer the questions, and reach the final step where you record a short video. Then the camera fails. A helpful popup tells you to paste one command into your terminal to fix it.
That single paste hands your machine to North Korea.
Researchers published a breakdown of this campaign on July 20, 2026. They tracked it to Famous Chollima, a North Korean threat group also known as Wagemole. The group has stolen an estimated 643 million dollars in crypto so far this year, according to figures cited from TRM Labs.
What Happened?
The operators built a fake hiring machine. They created fake firms and typosquatted real ones like Breezy HR, Paxos, HighMatch, and Rolevia. Then they reached out on LinkedIn, Discord, Telegram, and email with high salary pitches.
Targets were mostly non technical people in crypto and Web3. Legal advisors. Investment partners. Compliance heads. Financial managers. People who touch money but do not spend their day reading malware reports.
The assessment panel was built to feel real and feel stressful. A countdown timer runs on every section. Switch browser tabs and a warning modal accuses you of leaving the test. Open it on a phone and the site blocks you, because the payload only runs on desktop.
Then comes the camera error. The attackers trigger it manually from their own dashboard while watching you take the test.
The popup shows a harmless looking driver update command. When you copy it, a hidden script swaps your clipboard contents. You paste what looks like the same command. It runs an extra download in the background.
On Windows you get PylangGhost. On macOS you get GolangGhost plus a fake admin login window built in SwiftUI that asks for your password.
The Impact
Both RATs give attackers a remote shell, file upload and download, and full system profiling. They dig through Chrome and Edge for saved passwords. On Windows the malware impersonates the lsass.exe process to grab SYSTEM level access and break Chrome App Bound Encryption. On macOS it pulls the browser master password straight from Keychain.
The harvesting list targets 33 browser extensions. MetaMask, Coinbase Wallet, Trust Wallet, Ledger adjacent tools, and password managers like 1Password all appear on it. GolangGhost goes further and rewrites Chrome preference files to grant MetaMask extra permissions it never asked for.
Persistence is quiet. Windows gets a registry Run key named csshost. macOS gets a Launch Agent plist. C2 traffic is RC4 encrypted and sent over HTTP POST on port 8080, dressed up as ordinary binary traffic.
Here is the part companies keep missing. The panel harvests full PII before any malware runs. Name, email, phone, LinkedIn, work history. That data feeds North Korea’s fake IT worker operation, where operators apply for real remote jobs using stolen identities.
And people job hunt on work laptops. Researchers reported 1 in 3 employees admit using company tech to apply or interview elsewhere. One employee’s private job search becomes your corporate breach.
How to Avoid This
- Never paste a command you did not write into a terminal. No camera driver, no microphone fix, no browser patch requires this. Ever.
- Treat unsolicited recruiters as untrusted. Verify the company through its official site, not a link in the message.
- Keep personal job hunting off company hardware.
- Block clipboard hijacking risk by pasting into a text editor first, so you can see what you actually copied.
- Watch for new registry Run keys and unexpected Launch Agent plists on endpoints.
- Alert on Python or Go runtimes appearing in temp directories on machines that have no business compiling code.
- Run security awareness training for non technical staff, not just engineers. This campaign specifically avoids people who would spot it.
When the Attack Starts on a Personal Laptop and Ends in Your Network
A ClickFix paste leaves a trail. The problem is that the trail lands in an alert queue nobody gets to for six hours.
Secure.com Digital Security Teammates handle that gap:
- Autonomous L1 triage on endpoint alerts, so a suspicious process launch gets investigated in minutes instead of sitting in a queue
- Threat intel enrichment against IOCs like the C2 IP and typosquatted domains listed below, applied automatically to every matching alert
- Containment workflows that isolate the endpoint, disable the account, and rotate tokens, with human approval before anything executes
- Attack path modeling to show what a single compromised laptop can actually reach inside your environment
- Case records logged automatically, so the incident becomes audit evidence instead of a Slack thread
