ClickFake Interview Attack Leverages ClickFix Technique to Deploy GolangGhost Malware
Cybersecurity researchers have provided insight into a persistent threat cluster linked to the well-known North Korean state-sponsored hacker outfit Lazarus, according to a comprehensive analysis published in March by Sekoia’s Threat Detection and Response (TDR) team.
Dubbed “ClickFake Interview,” this operation represents an evolution of the group’s long-running “Contagious Interview” campaign, which has been targeting job seekers in the cryptocurrency and technology sectors since at least 2022.
The campaign exploits the allure of high-paying positions in decentralized finance (DeFi) and blockchain firms, luring victims with fake job interviews that ultimately lead to malware deployment.
Lazarus Group’s Sophisticated Campaign
Amid a hot summer surge in crypto-related scams, where fraudulent schemes have proliferated alongside volatile market conditions, this attack vector highlights the increasing sophistication of advanced persistent threats (APTs) in exploiting human vulnerabilities.
The ClickFake Interview cluster specifically leverages the innovative “ClickFix” technique, a social engineering ploy designed to bypass traditional security measures and directly compromise victim systems.
The ClickFix method involves presenting users with fabricated error messages during seemingly legitimate video conference setups or document previews, prompting them to copy and paste malicious commands into their terminal or command prompt.
This technique circumvents endpoint detection and response (EDR) tools by masquerading as troubleshooting steps for common software issues, such as codec installations or font rendering problems in applications like Zoom or PDF viewers.
Once executed, these commands initiate a multi-stage infection chain that deploys the GolangGhost malware a lightweight, cross-platform backdoor written in the Go programming language.
GolangGhost is engineered for stealth, utilizing obfuscated C2 (command-and-control) communications over HTTPS to evade network monitoring.
It supports functionalities like remote shell access, file exfiltration, and keystroke logging, making it ideal for espionage and data theft in targeted environments.
Sekoia’s analysis revealed that the malware’s payloads are often hosted on compromised legitimate domains or cloud services, further blending into benign traffic.
Indicators of compromise (IOCs) include specific mutex names, such as “GlobalGolangGhostMutex,” and anomalous registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun, which persist the malware across reboots.
Implications for Crypto Security
The ClickFake Interview campaign underscores Lazarus Group‘s adaptability, building on their history of high-profile attacks like the 2014 Sony Pictures hack and the 2017 WannaCry ransomware outbreak.
By integrating ClickFix with themed lures around crypto job opportunities such as invitations to discuss “smart contract auditing” roles attackers capitalize on the sector’s talent shortage and the remote work boom post-pandemic.
This has led to successful compromises in organizations handling sensitive financial data, potentially facilitating large-scale thefts similar to the $625 million Ronin Network breach attributed to Lazarus in 2022.
To counter such threats, experts recommend multi-layered defenses: implementing strict command execution policies via tools like Windows AppLocker or macOS Gatekeeper, educating users on verifying interview processes through official channels, and deploying behavioral analytics to detect anomalous paste operations.
According to the Report, Network segmentation and zero-trust architectures can also limit lateral movement post-infection.
As crypto markets continue to sizzle with volatility, vigilance against these sizzling scams remains paramount, with ongoing monitoring of Lazarus clusters like ClickFake essential for preempting future evolutions.
Sekoia’s report provides a comprehensive set of IOCs and YARA rules for threat hunters, emphasizing the need for collaborative intelligence sharing in the cybersecurity community to dismantle these persistent operations.
Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now
Source link
