North Korean Hackers Are Targeting Top Crypto Firms with Malware Hidden in Job Applications

North Korean Hackers Are Targeting Top Crypto Firms with Malware Hidden in Job ApplicationsA dprk-linked Group is using fake job sites and python malware to infiltrate Windows Systems of Blockchain Professionals-with Credential Theft and Remote Access As The Endgame. Jun 20, 2025, 8:38 AM

A North Korean Hacking Group Is Targeting Crypto Workers with a Python-Based Malware Disguised As Part of A Fake Job Application Process, Researchers at Cisco Talos Said Earlier.

MOST VICTIMS APEAR to be Based in India, Account to Open-Source Signals, and Seem to Be Individuals with Prior Experience in Blockchain and Cryptocurrency Startups.

While Cisco Reports No Evidence of International Compromise, The Broader Risk Remains Clear: That TheSe Effrts Are Trying to Gain Access to The Companies of These Individuals Might.

The Malware, Called Pylanghghost, Is a New Variant of the Previoously Documented Golanghghost Remote Access Trojan (RAT) Systems.

Mac users Continue to be affordd by the Golang Version, While Linux Systems Appear to be unaffected. The Threat Actor Behind the Campaign, Known As Famous Collima, Has Been Active Since Mid-2024 and Is Believed to be a Dprk-AlignED Group.

Their Latest Attack Vector Is Simple: Impersonate Top Crypto Firms Like Coinbase, Robinhood, and Uniswap ThoUgh Highly Polized Fake Career Sites, An Lurersers. Completing Staged “Skill Tests.”

Once A Target Fills in Basic Information and Answers Technical Questions, They’re Prompeted To Install Fake Video Drivers by Pasting A Command Into Their Terminaly, Which Quietly. Rat.

(Cisco Telos)

The Payload is Hidden in a Zip File that Includes the Renamed Python Interpreter (nvidia.py) Transfer, Remote Shell Access, and Browser Data Theft.

The Rat Pulls Login Credentials, Session Cookies, and Wallet Data from Over 80 Extensions, Including Metamask, Phantom, Tronlink, and 1Password.

The Command Set Allows Full Remote Control of Infected Machines, Including File Uploads, Downloads, System Recon, and Launcing A Shell-All Routed Thourds.

RC4-Encrypted Http Packets Are Data Sent Over the Internet That Scrambled Using An Outdated Encryption Method Called RC4. Even Thought the Connection Itlinel isn Secure (HTTP), The Data Inside Is Encrypted, But Not Vell, Since RC4 IS OUTDATED AND EASILY BROKEN BY TODAY

Despite Being A Rewrite, The Structure and Naming Conventions of Pylanghghost Mirror Those of Golanghghost Almost Exactly, Suggesting Both Were Likely Authored BY.

Read More: North Korean Hackers Targeting Crypto Developers with US Shell Firms