GolangGhost Steals Chrome Secrets From macOS Keychain and Hijacks MetaMask Permissions

A new malware campaign is targeting cryptocurrency and Web3 professionals through fake job interviews.

The operation delivers GolangGhost, a remote access trojan that can steal browser credentials, collect wallet data, and give attackers control of infected macOS systems.

The attackers pose as recruiters, offer attractive roles, and direct targets to fake online skill assessments.

At the final video-recording stage, the site displays a false camera error and persuades victims to copy and paste a supposed fix into their Mac Terminal.

SOCRadar said in a report shared with Cyber Security News (CSN) that the campaign is linked to the North Korean-aligned Famous Chollima group, also tracked as Wagemole.

The campaign delivers PylangGhost to Windows users and GolangGhost to macOS users through the same deceptive recruitment process.

The risk extends beyond a single compromised device. People working in crypto, investment, legal, advisory, and business roles may hold direct access to wallets, company accounts, or sensitive information that attackers can use to steal digital assets or move deeper into an organization.

Similar fake recruiter malware campaigns have repeatedly targeted the crypto sector.

GolangGhost Steals Chrome Secrets

On macOS, the copied command starts a Bash script that creates a hidden working directory, downloads a fake Intel driver archive, and retrieves the Go compiler needed to run GolangGhost.

The script also establishes persistence through a Launch Agent, allowing the malware to restart after a reboot.

GolangGhost can use the macOS Keychain command-line utility to retrieve Chrome’s stored master password. It then applies that secret to decrypt Chrome’s local database, exposing saved browser credentials and cookies that may grant access to online services.

This mirrors the danger seen in macOS credential stealing malware, which has also targeted browser data and wallet information.

The malware also searches for browser extension data associated with cryptocurrency wallets and password managers.

Its targets include MetaMask and several other wallet extensions, enabling attackers to collect extension settings and related data from Chrome profiles.

More concerningly, GolangGhost can alter Chrome’s Secure Preferences file after forcing the browser to close.

The malware injects broad permissions, including access to active tabs, clipboard writing, web requests, and expanded storage, then assigns them to the MetaMask extension. That change could let attackers abuse the wallet extension’s trusted browser position.

Fake Interviews Drive Infection

The ClickFake interview pages are designed to make victims act quickly. They collect personal information, fingerprint the visitor’s browser and device, block mobile users, show timed assessment questions, and display warnings when candidates switch browser tabs.

At the final step, the attackers present a realistic camera or microphone troubleshooting prompt.

The page replaces the harmless command copied by the victim with a malicious one, while displaying the expected text in Terminal to reduce suspicion.

Recent ClickFix malware campaigns show how this approach turns a victim’s own action into initial access.

The campaign also launches a fake macOS application that requests administrator credentials under the guise of an update.

Those credentials are sent to attacker-controlled infrastructure, adding another path to account takeover and device control.

Organizations should train staff, especially non-technical employees, to treat unsolicited interview requests and copy-and-paste troubleshooting steps as warning signs.

Security teams should prevent personal job hunting on corporate devices, review unexpected Launch Agents and browser-preference changes, and use detections that inspect suspicious compiled modules and dynamic libraries.

The threat also reinforces why teams should avoid untrusted recruitment software packages during hiring conversations.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

! ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposuremalware to businesses an