Copyright © BusinessAMBE 2023

Key takeaways

North Korean hackers are using sophisticated tactics to attack cryptocurrency professionals with malware hidden in fake job postings. This reports Decrypt.

Cisco Talos, a threat intelligence gathering company, identified the campaign as linked to "Famous Chollima," also known as "Wagemole." The hackers use a Python-based remote access trojan called "PylangGhost," designed to steal data and take control of victims' devices.

Legitimate crypto companies

The scheme relies on posing as legitimate cryptocurrency companies such as Coinbase, Robinhood and Uniswap through fake job postings. Victims are lured to fill out technical assessments on fraudulent websites that collect personal information. During a staged video interview, candidates are tricked into executing malicious commands disguised as necessary driver installations.

This malware can steal sensitive data from more than 80 browser extensions, including popular password managers and cryptowallets such as Metamask and 1Password. "PylangGhost" gives hackers persistent access to infected systems, allowing them to execute remote commands and potentially infiltrate cryptocurrency companies.

Experts

Experts suggest that India should implement cybersecurity audits for blockchain companies and monitor fake job portals to counter this threat. Strengthening legal provisions under the IT Act and launching digital awareness campaigns are also crucial steps to combat this evolving cybercrime landscape.

This campaign is part of North Korea's ongoing strategy to attack the cryptocurrency industry, with previous large-scale raids orchestrated by groups such as Lazarus. By targeting individual professionals, the regime is attempting to not only steal money, but also gain intelligence and potentially infiltrate crypto companies from within.

© The Content Exchange, source News