Skip to main content
AVOID.NET
← Famous Chollima ClickFake Interview Campaign (PylangGhost / GolangGhost)reviewed 2026-10-16 · 31 claims checked

Fact-check findings

What an automated fact-checker found when it re-read Famous Chollima ClickFake Interview Campaign (PylangGhost / GolangGhost) against the sources the page cites. Only the most recent review is shown.

Read this first

These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.

“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.

Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.

disputed 7unverifiable 3link rot 7partially supported 1confirmed 1314 corrections pending · 0 applied

disputed

7 claims

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

  1. #6[disputed][awaiting moderator]in section: PylangGhost Malware: Technical Capabilities
    “In newer variants, Cisco Talos documented the attackers compiling PylangGhost scripts into native Windows DLLs using Nuitka, an approach that converts Python to C++ then native binaries, substantially complicating signature-based detection and static analysis.”
    reviewerIn newer variants, Cisco Talos documented attackers compiling PylangGhost into native Windows DLLs using Nuitka.The Nuitka finding is real but was misattributed to Cisco Talos; it belongs to SOCRadar's July 2026 report, which the page's own timeline entry (2026-07-20) correctly credits, creating an internal inconsistency.
    Proposed correction (not yet applied)
    In newer variants, SOCRadar documented the attackers compiling PylangGhost scripts into native Windows DLLs using Nuitka, an approach that converts Python to C++ then native binaries, substantially complicating signature-based detection and static analysis.
    citedblog.talosintelligence.com/python-versio…golangghost-rat/
  2. #7[disputed][awaiting moderator]in section: PylangGhost Malware: Technical Capabilities
    “Cisco Talos documented 25 malware SHA256 hashes across PylangGhost modules and 23 fake job interview domains.”
    reviewerCisco Talos documented 25 malware SHA256 hashes across PylangGhost modules and 23 fake job interview domains.Both counts in the cited Talos source were checked directly against the article's IOC tables and do not match the page's figures.
    Proposed correction (not yet applied)
    Cisco Talos documented 21 malware SHA256 hashes across PylangGhost modules and 27 fake job interview domains.
    citedblog.talosintelligence.com/python-versio…golangghost-rat/
  3. #8[disputed][awaiting moderator]in section: Infrastructure and Indicators of Compromise
    “Fake interview assessment domains impersonate legitimate recruitment and crypto company branding; at least 23 such domains were identified by Cisco Talos.”
    reviewerAt least 23 fake interview assessment domains were identified by Cisco Talos.Same undercount as the PylangGhost technical section; both should read 27.
    Proposed correction (not yet applied)
    Fake interview assessment domains impersonate legitimate recruitment and crypto company branding; at least 27 such domains were identified by Cisco Talos.
    citedblog.talosintelligence.com/python-versio…golangghost-rat/
  4. #17[disputed][awaiting moderator]in section: Broader DPRK Crypto Theft Context
    “The FBI urged private sector entities including RPC node operators, exchanges, and DeFi services to block transactions associated with 52 Ethereum wallet addresses linked to the theft.”
    reviewerThe FBI urged blocking transactions associated with 52 Ethereum wallet addresses linked to the Bybit theft.Directly checked against the FBI PSA text; the address count is off by one.
    Proposed correction (not yet applied)
    The FBI urged private sector entities including RPC node operators, exchanges, and DeFi services to block transactions associated with 51 Ethereum wallet addresses linked to the theft.
    citedwww.ic3.gov/psa/2025/psa250226
  5. #20[disputed][awaiting moderator]in the timeline
    “2024-06”
    reviewerCampaign evolves in June 2024; GolangGhost backdoor and FrostyFerret macOS stealer first observed in ongoing fake interview operations.The month is moved to an approximate late-2024 date consistent with Talos's own wording ('toward the end of the year'); the source does not support a June/mid-2024 first-observation date for GolangGhost, and FrostyFerret is not documented in this source at all, so the event also partially misattributes authorship.
    Proposed correction (not yet applied)
    2024-10
    citedblog.talosintelligence.com/python-versio…golangghost-rat/
  6. #21[disputed][awaiting moderator]in the timeline
    “Sekoia publicly releases ClickFake Interview research; The Hacker News and Infosecurity Magazine cover findings. Campaign linked to 40+ companion domains registered in April 2025.”
    reviewerSekoia publicly releases ClickFake Interview research in April 2025; The Hacker News and Infosecurity Magazine cover the findings, and the campaign is linked to 40+ companion domains registered in April 2025.The Infosecurity Magazine citation is anachronistic for an April-2025 event (that outlet's relevant article is from July 2026), and no source checked supports the '40+ companion domains registered in April 2025' figure.
    Proposed correction (not yet applied)
    Sekoia publicly releases ClickFake Interview research; The Hacker News covers findings.
    citedthehackernews.com/2025/04/lazarus-group-…eekers-with.htmlwww.infosecurity-magazine.com/news/north…ckfake-campaign/
  7. #22[disputed][awaiting moderator]in the timeline
    “FBI IC3 releases public service announcement attributing the Bybit theft to North Korea's Lazarus Group (TraderTraitor) and publishing 52 associated Ethereum wallet addresses.”
    reviewerFBI IC3 releases public service announcement on February 26, 2025 publishing 52 associated Ethereum wallet addresses.Same undercount error as the Broader DPRK Crypto Theft Context section; both should read 51.
    Proposed correction (not yet applied)
    FBI IC3 releases public service announcement attributing the Bybit theft to North Korea's Lazarus Group (TraderTraitor) and publishing 51 associated Ethereum wallet addresses.
    citedwww.ic3.gov/psa/2025/psa250226

unverifiable

3 claims

No source the reviewer could reach confirms or contradicts the claim.

  1. #4[unverifiable][awaiting moderator]in section: Attribution and Threat Actor Background
    “Some vendors draw a further distinction, linking certain Famous Chollima sub-clusters to BlueNoroff or APT38, which are financial-theft-focused units historically responsible for bank heist operations.”
    reviewerSome vendors link certain Famous Chollima sub-clusters to BlueNoroff or APT38.Could not find any vendor report tying Famous Chollima sub-clusters specifically to BlueNoroff/APT38; North Korean group-naming overlap is well documented in general, but this specific linkage is unconfirmed either way.
    citedwww.crowdstrike.com/en-us/adversaries/famous-chollima/
  2. #12[unverifiable][awaiting moderator]in section: Attack Chain and Social Engineering Method
    “Attackers either create fictitious companies or impersonate well-known cryptocurrency firms including Coinbase, KuCoin, Kraken, Bybit, Robinhood, Tether, Circle, Securitize, BlockFi, Uniswap, Archblock, and Parallel Studios.”
    reviewerAttackers impersonate well-known cryptocurrency firms including Coinbase, KuCoin, Kraken, Bybit, Robinhood, Tether, Circle, Securitize, BlockFi, Uniswap, Archblock, and Parallel Studios.Every company name except Parallel Studios is corroborated across Sekoia, Talos and other reporting (e.g. GBHackers coverage naming Uniswap). No source checked mentions 'Parallel Studios' as an impersonated firm in this campaign.
    citedblog.sekoia.io/wp-content/uploads/2025/0…25-tlp-clear.pdfblog.talosintelligence.com/python-versio…golangghost-rat/
  3. #13[unverifiable][awaiting moderator]in section: Infrastructure and Indicators of Compromise
    “The domain talentacq.pro was observed in one active campaign, registered September 23 and weaponized less than two weeks later.”
    reviewerThe domain talentacq.pro was observed in one active campaign, registered September 23 and weaponized less than two weeks later.Could not locate this specific domain, registration date, or weaponization timeframe in any of the campaign's primary research reports checked.
    citedblog.talosintelligence.com/python-versio…golangghost-rat/blog.sekoia.io/wp-content/uploads/2025/0…25-tlp-clear.pdfwww.cryptika.com/new-clickfake-interview…ngghost-malware/

partially supported

1 claim

The cited evidence supports part of the claim but not all of it.

  1. #3[partially supported][awaiting moderator]in section: Attribution and Threat Actor Background
    “Sekoia and Cisco Talos place attribution within the 3rd Department of the Reconnaissance General Bureau (RGB) of the Democratic People's Republic of Korea, situating the group under the broader Lazarus Group organizational umbrella.”
    reviewerSekoia and Cisco Talos place attribution within the 3rd Department of the Reconnaissance General Bureau (RGB), under the Lazarus Group umbrella.Sekoia's RGB 3rd Department attribution is confirmed, but attributing the same specific sub-unit claim to Cisco Talos overstates what that source says; CrowdStrike's competing profile attributes the group to a different DPRK body (Munitions Industry Department) entirely, underscoring that attribution to a specific RGB department is not vendor-consensus.
    citedwww.sekoia.com/blog/clickfake-interview-…paign-by-lazarusblog.talosintelligence.com/python-versio…golangghost-rat/

confirmed

13 claims

The cited evidence supports the claim as written.

  1. #1[confirmed][no action needed]in section: Attribution and Threat Actor Background
    “The ClickFake Interview campaign is attributed with high confidence to Famous Chollima, also tracked as Wagemole, Storm-1877, UNC5267, NICKEL TAPESTRY, Tenacious Pungsan, Void Dokkaebi, Contagious Interview, PurpleBravo, and DEV#POPPER by various security vendors.”
    reviewerFamous Chollima is also tracked as Wagemole, Storm-1877, UNC5267, NICKEL TAPESTRY, Tenacious Pungsan, Void Dokkaebi, Contagious Interview, PurpleBravo, and DEV#POPPER by various security vendors.Every alias in the list is independently corroborated across CrowdStrike and The Hacker News.
    citedwww.crowdstrike.com/en-us/adversaries/famous-chollima/thehackernews.com/2025/04/lazarus-group-…eekers-with.html
  2. #2[confirmed][no action needed]in section: Attribution and Threat Actor Background
    “CrowdStrike designates the group Famous Chollima and states it has been active since at least 2018.”
    reviewerCrowdStrike states Famous Chollima has been active since at least 2018.Directly confirmed on CrowdStrike's adversary profile.
    citedwww.crowdstrike.com/en-us/adversaries/famous-chollima/
  3. #5[confirmed][no action needed]in section: PylangGhost Malware: Technical Capabilities
    “PylangGhost is a Python-based remote access trojan (RAT) first identified by Cisco Talos in May 2025 and documented as exclusive to Famous Chollima.”
    reviewerPylangGhost was first identified by Cisco Talos in May 2025 and is exclusive to Famous Chollima, built from six Python modules, using RC4-encrypted HTTP C2 and targeting over 80 browser extensions.Confirmed in detail against the primary Talos writeup.
    citedblog.talosintelligence.com/python-versio…golangghost-rat/
  4. #9[confirmed][no action needed]in section: PylangGhost Malware: Technical Capabilities
    “One confirmed sample hash: c2137cd870de0af6662f56c97d27b86004f47b866ab27190a97bde7518a9ac1b.”
    reviewerOne confirmed PylangGhost sample hash is c2137cd870de0af6662f56c97d27b86004f47b866ab27190a97bde7518a9ac1b.Verified present in the cited source's IOC table.
    citedblog.talosintelligence.com/python-versio…golangghost-rat/
  5. #10[confirmed][no action needed]in section: GolangGhost Malware: Technical Capabilities
    “GolangGhost is a Go-based remote access trojan targeting macOS systems, documented initially by Sekoia in March 2025 and subsequently analyzed by multiple vendors. It is delivered on macOS as the final stage following FrostyFerret's system password theft. GolangGhost version 2.0.1 was identified in analyzed samples.”
    reviewerGolangGhost was documented initially by Sekoia in March 2025, and GolangGhost version 2.0.1 was identified in analyzed samples.Both the initial-documentation date and version number are independently corroborated, though the version figure is confirmed via PolySwarm rather than the sources formally cited in this section.
    citedblog.sekoia.io/wp-content/uploads/2025/0…25-tlp-clear.pdfmalpedia.caad.fkie.fraunhofer.de/details/win.golangghost
  6. #11[confirmed][no action needed]in section: Targeted Sectors and Victim Profile
    “Sekoia's March 2025 report identified at least 14 cryptocurrency companies whose identities are impersonated in fake recruitment lures, predominantly centralized finance (CeFi) platforms including Coinbase, KuCoin, Kraken, Bybit, Robinhood, Tether, Circle, Securitize, and BlockFi, with at least one decentralized finance platform (Archblock).”
    reviewerSekoia's March 2025 report identified at least 14 cryptocurrency companies impersonated in fake recruitment lures, including Archblock as the lone DeFi platform.Confirmed in detail.
    citedwww.sekoia.com/blog/clickfake-interview-…paign-by-lazarus
  7. #14[confirmed][no action needed]in section: Attack Chain and Social Engineering Method
    “Attackers register their assessment domains predominantly through Hostinger and NameCheap, prioritizing volume and speed over operational security longevity.”
    reviewerAttackers register their assessment domains predominantly through Hostinger and NameCheap.Confirmed by two independent sources.
    citedsocradar.io/blog/dprk-clickfake-pylanggh…olangghost-rats/www.infosecurity-magazine.com/news/north…ckfake-campaign/
  8. #15[confirmed][no action needed]in section: Targeted Sectors and Victim Profile
    “Cisco Talos telemetry indicates a limited observed impact with victims predominantly concentrated in India, suggesting targeted rather than mass-scale operations. No Cisco customers were confirmed among affected parties in Talos's reporting period.”
    reviewerCisco Talos telemetry indicates a limited observed impact with victims predominantly in India, and no Cisco customers were confirmed affected.Matches the source directly.
    citedblog.talosintelligence.com/python-versio…golangghost-rat/
  9. #16[confirmed][no action needed]in section: Broader DPRK Crypto Theft Context
    “The FBI confirmed via an IC3 public service announcement dated February 26, 2025 that the Lazarus Group (designated TraderTraitor by the FBI) was responsible for stealing approximately $1.5 billion USD from Bybit on or about February 21, 2025 — the largest crypto theft on record.”
    reviewerThe FBI confirmed via an IC3 PSA dated February 26, 2025 that Lazarus Group (TraderTraitor) stole approximately $1.5 billion from Bybit on or about February 21, 2025.Confirmed verbatim against the primary FBI source.
    citedwww.ic3.gov/psa/2025/psa250226
  10. #18[confirmed][no action needed]in section: Broader DPRK Crypto Theft Context
    “DPRK-linked actors stole an estimated $2.02 billion in cryptocurrency in 2025 alone, a 51% year-on-year increase, pushing their alleged all-time cumulative total to approximately $6.75 billion.”
    reviewerDPRK-linked actors stole an estimated $2.02 billion in cryptocurrency in 2025, a 51% year-on-year increase, pushing cumulative theft to approximately $6.75 billion.Confirmed via multiple independent news reports of the Chainalysis 2026 Crypto Crime Report, released December 2025.
    citedwww.csis.org/analysis/bybit-heist-and-fu…rypto-regulation
  11. #19[confirmed][no action needed]in the timeline
    “Contagious Interview campaign begins, targeting software developers via fake GitHub-hosted coding assessments. Attributed to Famous Chollima / Lazarus Group.”
    reviewerContagious Interview campaign begins in December 2022, and Palo Alto Networks publicly documents it for the first time in November 2023.Both the December 2022 origin date and the November 2023 public disclosure are corroborated.
    citedblog.sekoia.io/wp-content/uploads/2025/0…25-tlp-clear.pdfthehackernews.com/2025/04/lazarus-group-…eekers-with.html
  12. #23[confirmed][no action needed]in the timeline
    “Microsoft Security Blog publishes detailed analysis of the Contagious Interview malware delivery campaign including BeaverTail, InvisibleFerret, and related tooling.”
    reviewerMicrosoft Security Blog publishes detailed analysis of the Contagious Interview malware delivery campaign on March 11, 2026, including BeaverTail and InvisibleFerret.Confirmed live and accurate.
    citedwww.microsoft.com/en-us/security/blog/20…-job-interviews/
  13. #24[confirmed][no action needed]in the timeline
    “SOCRadar Threat Research Unit publishes updated analysis of the ClickFake Interview campaign documenting PylangGhost and GolangGhost targeting Web3 professionals, with new infrastructure observations including Nuitka-compiled variants.”
    reviewerSOCRadar Threat Research Unit publishes updated analysis on July 20, 2026 documenting PylangGhost/GolangGhost with new infrastructure including Nuitka-compiled variants.Confirmed; this is the entry that correctly attributes the Nuitka finding, unlike the PylangGhost technical section which misattributes it to Talos.
    citedsocradar.io/blog/dprk-clickfake-pylanggh…olangghost-rats/
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.