Loading malware…
FriendlyFerret is a macOS malware variant associated with the DPRK-linked Lazarus fake-job-interview activity commonly tracked as Contagious Interview and its later evolution ClickFake Interview. Public reporting places it in the same macOS malware cluster as FrostyFerret and FlexibleFerret, and alongside other malware used in the broader campaign such as BeaverTail, InvisibleFerret, OtterCookie, GolangGhost, and PylangGhost. The campaign has targeted software developers, cryptocurrency and DeFi personnel, and later broader finance-sector job seekers through fraudulent recruiting workflows, including legitimate-looking interview websites and trojanized applications. High-confidence reporting in the provided content specifically identifies FriendlyFerret as one of the macOS variants of InvisibleFerret. InvisibleFerret is described as supporting remote control, data exfiltration, browser theft, and keylogging. The activity is attributed in reporting to North Korean threat actors, including Lazarus, and has used fake interview and recruiting lures to compromise victims.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Three variants, FriendlyFerret, FrostyFerret and FlexibleFerret, were deployed during a job interview process on a legitimate website.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Multiple items describe the DPRK/Lazarus “Contagious Interview” campaign using fake recruiters/job listings/interviews (incl. LinkedIn) to lure developers into running malware (e.g., “Sophisticated LinkedIn Recruiting Scam”, “fake AI recruiter”, “Job Offer from the North”).
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named DPRK-linked malware variant referenced alongside FlexibleFerret and FrostyFerret.
Variant in the Ferret malware line referenced as deployed during job-interview themed infection flows; specific capabilities not detailed in this content.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.