Loading malware…
GolangGhost is a Go-based remote access trojan associated with North Korean threat activity, especially the Contagious Interview and ClickFake Interview social-engineering campaigns attributed to clusters tracked as Famous Chollima, Wagemole, WaterPlum, and related Lazarus-linked operations. It is also referred to as FlexibleFerret and WeaselStore in reporting that treats the Go and Python implementations as closely related variants, with PylangGhost representing the Python counterpart.
The malware is used primarily against macOS victims in fake job interview and recruiter-themed operations targeting cryptocurrency, blockchain, Web3, AI, and software-development communities, though some reporting also describes Windows-oriented delivery chains. Infection commonly follows highly tailored recruiter outreach and fraudulent assessment portals that present fake camera or microphone troubleshooting prompts and trick victims into copying and executing terminal commands. These campaigns have also used broader developer-focused lures involving malicious repositories and coding assessments.
GolangGhost is a modular RAT/backdoor with command execution and file transfer functionality, encrypted HTTP-based command-and-control communications, persistence, and integrated credential and wallet theft. Reported modules and behaviors include orchestration, configuration handling, archive or compression support, command launching, C2 communications, and data-stealing components. On macOS it has been observed establishing persistence through Launch Agents. It performs host checks and anti-analysis logic, including virtual-machine or sandbox detection in some variants.
A core function of GolangGhost is theft of browser secrets and cryptocurrency-related data. It has been reported stealing saved browser credentials, cookies, session data, and data from numerous browser extensions, including cryptocurrency wallets and password managers. On macOS, it can retrieve browser protection secrets from the Keychain to decrypt stored Chromium credentials. Some reporting also describes functionality to harvest wallet extension data, collect private keys, and manipulate Chromium Secure Preferences to grant elevated permissions to a wallet extension, enabling abuse of the victim's trusted browser context. Linux credential-decryption logic has also been reported in code comparisons, indicating cross-platform design heritage even when campaigns primarily targeted macOS.
GolangGhost is financially motivated malware aligned with DPRK cryptocurrency theft operations. Victims have included developers, job seekers, advisors, legal and business personnel, and other employees with potential access to wallets, cloud resources, credentials, or company funds. Its role in these campaigns is to provide persistent remote access while stealing credentials and wallet material that can support direct cryptocurrency theft, follow-on intrusion, and compromise of organizational infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For macOS users, the attack path is similarly streamlined but the toolset is built around different programming language. The malicious terminal command fetches and executes GolangGhost, a remote access trojan written in Go.
If you're on a Mac, it's GoLangGhost, which is a remote access Trojan written in Go.
Toward the end of the year, researchers documented Famous Chollima’s remote access trojan (RAT) called “GolangGhost” in its source code format, which was frequently used as the final payload in the threat actor’s ClickFix campaigns.
BlockNovas has been observed using video assessments to distribute FROSTYFERRET and GolangGhost using ClickFix-related lures...
ClickFake Interview leverages fake job interview websites to deploy a Go backdoor – GolangGhost – on Windows and macOS environments... This final implant enables remote control and data theft, including browser information exfiltration. | Three variants, FriendlyFerret, FrostyFerret and FlexibleFerret, were deployed during a job interview process on a legitimate website.
Lazarus Group Targets Job Seekers With ClickFix Tactic to Deploy GolangGhost Malware
32 distinct techniques documented for this family, organized by ATT&CK tactic.
the TraderTraitor operators invited the victims to collaborate on a GitHub repository that contained malicious JavaScript packages sourced from npm as dependencies [T1195.001]
Famous Chollima... create an entirely fake business... or they impersonate a real one in the cryptocurrency sector... they go looking for potential targets on LinkedIn... The hackers, they're posing as recruiters. They pitch a lucrative new role.
The attack begins on mainstream professional networks and communication platforms, including LinkedIn, Telegram, Discord and direct email. Posing as recruiters from reputable firms or creating entirely fictitious web companies, the actors reach out to developers and administrators.
it pastes something from your clipboard into your terminal screen, the Run command, in order to download a piece of malicious code.
On macOS, the copied command starts a Bash script that creates a hidden working directory, downloads a fake Intel driver archive, and retrieves the Go compiler needed to run GolangGhost.
The auto module of both variants, actively attempts to elevate its privileges by temporarily impersonating the Windows lsass.exe process to gain SYSTEM-level access, and interacts directly with the Windows Cryptography API to unwrap the browser’s master decryption key.
Both variants have a util module that is responsible for compressing and decompressing files.
The auto module of both variants, actively attempts to elevate its privileges by temporarily impersonating the Windows lsass.exe process to gain SYSTEM-level access, and interacts directly with the Windows Cryptography API to unwrap the browser’s master decryption key.
The campaign also launches a fake macOS application that requests administrator credentials under the guise of an update. Those credentials are sent to attacker-controlled infrastructure
macOS chain included a SwiftUI app that prompts for user credentials.
It is specifically programmed to harvest session data, saved credentials and private keys from widely used cryptocurrency wallets such as MetaMask, Phantom and TronLink, as well as commercial password managers like NordPass.
It is specifically programmed to harvest session data, saved credentials and private keys from widely used cryptocurrency wallets such as MetaMask, Phantom and TronLink, as well as commercial password managers like NordPass.
GolangGhost can use the macOS Keychain command-line utility to retrieve Chrome’s stored master password.
It then applies that secret to decrypt Chrome’s local database, exposing saved browser credentials and cookies that may grant access to online services.
The malware injects broad permissions, including access to active tabs, clipboard writing, web requests, and expanded storage, then assigns them to the MetaMask extension.
On Apple devices, the infection process often installs the primary payload alongside a credential-harvesting helper application built with SwiftUI, which is specifically designed to trick macOS users into surrendering their administrative passwords.
The malware also searches for browser extension data associated with cryptocurrency wallets and password managers.
The campaign also launches a fake macOS application that requests administrator credentials under the guise of an update. Those credentials are sent to attacker-controlled infrastructure
macOS chain included a SwiftUI app that prompts for user credentials.
If you try and copy and paste that link from the web interface, what actually gets copied into your clipboard is something else. And that command, which you then paste in at the command prompt... is downloading from another site entirely.
Both PylangGhost and GolangGhost are built on a highly modular architecture consisting of six interconnected parts. These components include a main orchestrator, a dedicated configuration holder, an archive helper, a command launcher, a command-and-control (C2) communications module and a specialized data stealer.
The script utilizes native system utilities like PowerShell or curl to fetch a compressed ZIP archive from the attacker's server.
170 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Go-based remote access Trojan for macOS delivered through the same fake interview/click-fix campaign. It provides remote shell access, supports file transfer, credential theft, and theft from cryptocurrency wallet browser extensions.
A macOS-focused remote access trojan delivered via fake job interview lures. It establishes persistence through a Launch Agent, retrieves Chrome secrets from the macOS Keychain to decrypt stored credentials and cookies, harvests cryptocurrency wallet extension data, and modifies Chrome Secure Preferences to grant broad permissions to the MetaMask extension for abuse.
A Go-based remote access trojan used against macOS users in recruiter-themed social engineering attacks. It is part of a modular malware suite with command execution, persistence, C2 communications, and credential and crypto-wallet theft capabilities.
A named remote access trojan reportedly deployed in a ClickFake job interview campaign attributed in the post to DPRK-linked Famous Chollima.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.