Famous Chollima: Developer Lures, Malware Tactics and IT-Worker Scheme
Summary
Picus’s overview describes Famous Chollima’s fake-recruiter coding tests, malicious npm, VS Code and Git-hook execution, malware capabilities, and fraudulent IT-worker scheme, drawing on cited research.
Key points
- The article says fake recruiters use coding assessments hosted on GitHub, Bitbucket and GitLab to deliver trojanized repositories to developers.
- Loaders can execute through npm lifecycle scripts, VS Code folder-open tasks and Git hooks, then retrieve and run remote scripts.
- The article describes BeaverTail and OtterCookie stealing browser credentials and cryptocurrency wallet data; some OtterCookie variants also capture keystrokes and screenshots and collect files.
- ClickFix-style skill tests reportedly trick candidates into pasting commands that download and launch PylangGhost.
- OtterCookie’s remote-shell module uses Socket.IO over HTTP and WebSocket; the article also describes checks for virtualized environments.
- The article reports that US authorities shut down more than 40 laptop farms linked to the fraudulent IT-worker scheme and charged 14 people, while operations were said to be ongoing.
Article Details
- Attack Vectors
- Fake recruiters invite developers to interviews and direct them to trojanized coding assessments hosted on GitHub, Bitbucket, or GitLab; malicious npm dependencies and repository code deliver loaders.
- npm lifecycle scripts, VS Code folder-open tasks, and Git hooks trigger payload execution when victims install packages or open and use assessment repositories.
- Loaders fetch JavaScript and execute it dynamically; payloads may be concealed in whitespace or disguised as font and SVG files.
- ClickFix pages show a fake camera or microphone error and instruct victims to paste a PowerShell command that downloads and launches PylangGhost.
- Fraudulent IT workers use fake or stolen identities and US laptop farms to maintain insider access at employers; the article reports data theft and ransom demands to prevent leaks.
- BeaverTail, OtterCookie, PylangGhost, and InvisibleFerret collect browser credentials, cookies, wallet or extension data, files, keystrokes, screenshots, or clipboard contents and communicate with remote servers.
- Defensive Notes
- The article recommends using the Picus Threat Library to simulate Famous Chollima campaigns and validate security controls.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]nvidia-release[.]org | Attacker-registered payload host disguised as a driver-fix service. |
| DOMAIN | api[.]quickcamfix[.]online | Attacker-registered payload host disguised as a driver-fix service. |
| DOMAIN | coinbase[.]talenthiringtool[.]com | Attacker-registered fake skill-testing portal used to target job seekers. |
| DOMAIN | krakenhire[.]com | Attacker-registered fake assessment portal used to target job seekers. |
| IPV4 | 195[.]201[.]172[.]170 | IP address recovered in the article's example of an obfuscated Famous Chollima C2 URL. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes payloads concealed with whitespace, Base64 encoding, XOR decoding, renamed variables, and JavaScript obfuscation.T1036.008 · Masquerade File TypeThe group disguises obfuscated JavaScript as web-font files and also hides payloads in SVG files.T1056.001 · KeyloggingAn OtterCookie variant captures keystrokes, buffers them in a temporary file, and uploads them.T1059.007 · JavaScriptRepository loaders fetch JavaScript and execute it by constructing a function from the downloaded response.T1071.001 · Web ProtocolsOtterCookie uses HTTP followed by WebSocket communication for remote commands, while BeaverTail and PylangGhost also communicate with C2 over HTTP.T1195.001 · Compromise Software Dependencies and Development ToolsThe group publishes malicious npm dependencies; installing node-nvm-ssh in a trojanized application triggered BeaverTail and OtterCookie payloads.T1204.002 · Malicious FileOpening an assessment repository and granting VS Code Workspace Trust can run a folder-open task that activates the malicious Git hook.T1204.004 · Malicious Copy and PasteClickFix pages instruct victims to copy and paste a command that downloads and launches a PylangGhost package.T1204.005 · Malicious LibraryA malicious npm prepare lifecycle script runs the payload during package installation.T1497.001 · System ChecksOtterCookie checks Linux system information for virtualization indicators and marks the host profile as a VM or local system.T1555.003 · Credentials from Web BrowsersBeaverTail, OtterCookie, and PylangGhost steal saved browser credentials; PylangGhost also collects session cookies.T1566.003 · Spearphishing via ServiceFake recruiters contact developers through LinkedIn and direct them to assessments on repository platforms; freelancers are also contacted through Fiverr and Discord.T1583.001 · DomainsThe article says Famous Chollima registers domains for fake recruitment portals and payload delivery, including the listed hiring-themed and driver-fix domains.T1608.001 · Upload MalwareThe group stages loaders in public coding-assessment repositories and stages next-stage JavaScript for retrieval.T1684.001 · ImpersonationThe group's fraudulent IT workers impersonate US-based employees using fake or stolen identities.
Threat Actors
Contagious InterviewThe article lists Contagious Interview as an alias of Famous Chollima and also describes it as a fake-interview campaign used to infect software developers.Gwisin GangThe article names Gwisin Gang as an alias of Famous Chollima, which it describes as conducting fake-recruiter malware campaigns and fraudulent IT-worker placements.ItworkersThe article names Itworkers as an alias of Famous Chollima, which it describes as conducting fake-recruiter malware campaigns and fraudulent IT-worker placements.Nickel TapestryThe article names Nickel Tapestry as an alias of Famous Chollima, which it describes as conducting fake-recruiter malware campaigns and fraudulent IT-worker placements.PurpleBravoThe article names PurpleBravo as an alias of Famous Chollima, which it describes as conducting fake-recruiter malware campaigns and fraudulent IT-worker placements.Storm-1877The article names Storm-1877 as an alias of Famous Chollima, which it describes as conducting fake-recruiter malware campaigns and fraudulent IT-worker placements.Storm0287The article names Storm0287 as an alias of Famous Chollima, which it describes as conducting fake-recruiter malware campaigns and fraudulent IT-worker placements.Tenacious PungsanThe article names Tenacious Pungsan as an alias of Famous Chollima, which it describes as conducting fake-recruiter malware campaigns and fraudulent IT-worker placements.UNC5267The article names UNC5267 as an alias of Famous Chollima, which it describes as conducting fake-recruiter malware campaigns and fraudulent IT-worker placements.Void DokkaebiThe article describes Famous Chollima as a North Korean, state-sponsored, financially motivated group involved in fake-recruiter malware campaigns and fraudulent IT-worker placements.WagemoleThe article names WageMole as an alias of Famous Chollima, which it describes as conducting fake-recruiter malware campaigns and fraudulent IT-worker placements.
Malware
BeaverTailMarch 2026 - Launches PolinRider, implanting obfuscated JavaScript in hundreds of GitHub repositories to spread a BeaverTail variant.GolangGhostFebruary 2025 - Adopts ClickFix lures, tricking crypto job seekers into running commands that install the GolangGhost backdoor.InvisibleFerretPython modules downloaded by BeaverTail and InvisibleFerret decode themselves at runtime.OtterCookieSeptember 2024 - Introduces OtterCookie, a new JavaScript malware that steals victim data via Socket.IO communication.PolinRiderMarch 2026 - Launches PolinRider, implanting obfuscated JavaScript in hundreds of GitHub repositories to spread a BeaverTail variant.PylangGhostfolder-open tasks, Git hooks, and payloads disguised as font or SVG files, while ClickFix pages deploy PylangGhost.
Products
1Passwordcookies and collects data from more than 80 extensions, including password managers and wallets such as 1Password, NordPass, MetaMask, and Phantom.BitbucketFake recruiters lure developers into coding assessments hosted on GitHub, Bitbucket, or GitLab that hide malicious loaders.GitHubFake recruiters lure developers into coding assessments hosted on GitHub, Bitbucket, or GitLab that hide malicious loaders.GitLabFake recruiters lure developers into coding assessments hosted on GitHub, Bitbucket, or GitLab that hide malicious loaders.MetaMaskdata from more than 80 extensions, including password managers and wallets such as 1Password, NordPass, MetaMask, and Phantom.NordPasscollects data from more than 80 extensions, including password managers and wallets such as 1Password, NordPass, MetaMask, and Phantom.Phantomthan 80 extensions, including password managers and wallets such as 1Password, NordPass, MetaMask, and Phantom.Picus PlatformSimulate APT Attacks with 14-Day Free Trial of Picus PlatformPicus Threat LibraryThe Picus Threat Library includes Famous Chollima threats, letting teams simulate attacks and validate their security controls.VS CodePayloads execute through npm lifecycle scripts, VS Code folder-open tasks, Git hooks, and files disguised as fonts or SVGs.
Countries
IndiaFamous Chollima is a North Korean, financially motivated APT group active since 2018, notably targeting the US and India.North Korea2018 (at least) - Becomes active, conducting operations that illicitly obtain IT jobs to earn salaries funneled to North Korea.United StatesFamous Chollima is a North Korean, financially motivated APT group active since 2018, notably targeting the US and India.
Industries
AerospaceIt targets software developers and cryptocurrency professionals, notably in the US and India, and organizations in aerospace, energy, finance, healthcare, defense, and technology.CryptocurrencyIt targets software developers and cryptocurrency professionals, notably in the US and India, and organizations in aerospace, energy, finance, healthcare, defense, and technology.DefenseIt targets software developers and cryptocurrency professionals, notably in the US and India, and organizations in aerospace, energy, finance, healthcare, defense, and technology.EnergyIt targets software developers and cryptocurrency professionals, notably in the US and India, and organizations in aerospace, energy, finance, healthcare, defense, and technology.financeIt targets software developers and cryptocurrency professionals, notably in the US and India, and organizations in aerospace, energy, finance, healthcare, defense, and technology.HealthcareIt targets software developers and cryptocurrency professionals, notably in the US and India, and organizations in aerospace, energy, finance, healthcare, defense, and technology.TechnologyIt targets software developers and cryptocurrency professionals, notably in the US and India, and organizations in aerospace, energy, finance, healthcare, defense, and technology.