Coinbase Impersonated in North Korean ’PylangGhost’ Crypto Malware Attack

North Korean hackers have escalated their targeting of cryptocurrency professionals with a new Python-based malware called 'PylangGhost.' Posing as recruiters from major firms like Coinbase, Robinhood, and Uniswap, the attackers lure victims into fake job interviews and skill-testing websites. Once engaged, the malware compromises over 80 browser extensions and crypto wallets, posing a significant threat to digital asset security. Cybersecurity experts at Cisco Talos have identified this sophisticated attack vector, emphasizing the need for heightened vigilance in the crypto community.

North Korean Hackers Target Crypto Professionals with 'PylangGhost' Trojan

North Korean cybercriminals have intensified their focus on the cryptocurrency sector, deploying a sophisticated Python-based malware dubbed 'PylangGhost.' The malware is distributed through fake job interviews impersonating major companies like Coinbase, Robinhood, and Uniswap. Victims are lured into skill-testing websites that ultimately compromise over 80 browser extensions and crypto wallets.

Cisco Talos researchers attribute the campaign to the notorious 'Famous Chollima' threat group, which has primarily targeted crypto professionals in India. The operation leverages social engineering, with victims tricked into executing malicious commands disguised as video driver installations for fake interview recordings.

This marks the latest escalation in North Korea's systematic attacks on the cryptocurrency industry, which have already yielded over $1.3 billion in stolen funds across 47 incidents in 2024, according to Chainalysis.

North Korea Targets Crypto Professionals With New Malware in Hiring Scams

Hackers affiliated with North Korea have launched a sophisticated malware campaign targeting cryptocurrency professionals. Posing as recruiters from prominent platforms like Coinbase and Uniswap, they deploy "PylangGhost," a Python-based trojan designed to infiltrate systems.

The operation underscores Pyongyang's continued focus on cybercrime as a revenue stream. By impersonating legitimate industry players, attackers exploit trust within the crypto community to gain access to sensitive data and assets.