How do you trick someone into installing malware without triggering alarms? 
North Korea’s Lazarus group is doing it using a method called ClickFix, blending social engineering with targeted job scams to infect victims — and steal cryptocurrency. According to security firm Sekoia, this latest campaign, dubbed *ClickFake Interview*, impersonates legitimate crypto firms like Coinbase, Kraken, or Robinhood. Victims are contacted via social media and invited to fake job interviews hosted on cloned websites.
The process looks legitimate: candidates fill out forms, answer questions, and are asked to record an introduction video. But when they try to enable their webcam, a fake error kicks off the attack. The page tells them to fix the issue by downloading a driver or copying and running command-line code — that's the ClickFix technique. It exploits the victim’s unfamiliarity with system-level actions, especially among non-technical professionals in centralized finance (CeFi).
Based on the victim's operating system (identified via their browser’s User-Agent), the attackers deploy different payloads. On macOS, a bash script downloads "FrostyFerret," a password stealer, followed by "GolangGhost," a backdoor. On Windows, a VBScript fetches GolangGhost via NodeJS. This implant gives Lazarus remote control over the target’s machine, allowing data exfiltration, including sensitive browser information.
While earlier Lazarus campaigns had targeted developers, this one specifically aims at individuals with weaker technical defenses. Meanwhile, other threat actors are also adopting ClickFix — for example, distributing Qakbot through LinkedIn-based scams.
Sekoia has released detection rules and indicators of compromise (IOCs) to help defenders identify and counter the campaign. The broader concern is this: ClickFix sidesteps traditional safeguards not with technical brute force, but by using trust as the primary weapon.
#Infosec #Cybersecurity #Software #Technology #News #CTF #Cybersecuritycareer #hacking #redteam #blueteam #purpleteam #tips #opensource #cloudsecurity
— 
P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking 
Project link on #GitHub 
https://github.com/Orange-Cyberdefense/GOAD
