#famouschollima — Public Fediverse posts

📢 Faux travailleurs nord-coréens : Famous Chollima infiltre des entreprises via l'emploi frauduleux

Cet article analyse en profondeur la menace des faux travailleurs nord-coréens, opération attribuée au groupe Famous Chollima (également suivi sous les noms UNC5267 par Mandiant/Google, Jasper Sleet par Microsoft, et associé à Wagemole)…

📖 cyberveille : https://cyberveille.ch/posts/2026-09-14-faux-travailleurs-nord-coreens-famous-chollima-infiltre-des-entreprises-via-l-emploi-frauduleux/
🌐 source : https://blog.barracuda.com/2026/09/14/the-fake-worker-threat-and-the-rise-of-human-infiltration
🟡 vérification factuelle moyenne
#FamousChollima #FauxTravailleurs #Cyberveille

📢 Chaîne de dépendances npm malveillantes ulid-xyz liée au groupe FAMOUS CHOLLIMA (DPRK)

Cet article présente une analyse technique approfondie d'une chaîne de livraison de malware via l'écosystème npm, détectée en juin 2026 et référencée sous l'advisory MAL-2026-6672. L'attaque repose sur trois packages npm imbriqués : ioredis-xyz (Layer 1)…

📖 cyberveille : https://cyberveille.ch/posts/2026-09-01-chaine-de-dependances-npm-malveillantes-ulid-xyz-liee-au-groupe-famous-chollima-dprk/
🌐 source : https://safedep.io/ulid-xyz-transitive-dependency-delivery-chain/
🟡 vérification factuelle moyenne
#DPRK #FAMOUSCHOLLIMA #Cyberveille

Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup
#FAMOUSCHOLLIMA
https://any.run/cybersecurity-blog/lazarus-group-it-workers-investigation-part-two/

North Korea's ClickFake Interview campaign targets crypto pros with fake skill tests, dropping the PylangGhost RAT on Windows and GolangGhost on macOS.

#ClickFake #PylangGhost #GolangGhost #NorthKorea #FamousChollima #ClickFix #Crypto #Cybersecurity

https://securityonline.info/clickfake-interview-pylangghost/?utm_source=mastodon&utm_medium=jetpack_social

Who Needs a Job? DPRK ClickFake Interview Campaign Drops PylangGhost and GolangGhost RATs
#PylangGhost #GolangGhost #FAMOUSCHOLLIMA
https://socradar.io/blog/dprk-clickfake-pylangghost-golangghost-rats/

I found a malware hiding in my tailwindcss config file.
#Tailwindcss #FAMOUSCHOLLIMA
https://infosecwriteups.com/i-found-north-korean-dprk-malware-hiding-in-my-tailwind-config-js-45af2283742c

North Korean Hackers Exploit Developer Tools in Malware Campaigns

North Korean hackers have launched a sneaky malware campaign, tricking victims into executing cross-platform malware for macOS, Linux, and Windows through malicious scripts hidden in GitHub repositories. Their latest tactic, dubbed UNK_DeadDrop, uses recruitment lures to deliver self-running code to over 75% of…

https://osintsights.com/north-korean-hackers-exploit-developer-tools-in-malware-campaigns?utm_source=mastodon&utm_medium=social

#NorthKoreanHackers #ContagiousInterview #FamousChollima #Hexagonalrodent #VoidDokkaebi

Void Dokkaebi evolve InvisibleFerret: il malware nordcoreano ora usa Cython per sfuggire agli antivirus

https://insicurezzadigitale.com/void-dokkaebi-evolve-invisibleferret-il-malware-nordcoreano-ora-usa-cython-per-sfuggire-agli-antivirus/

AI-Assisted Code Targets Crypto Wallets via Malicious npm Dependency

Researchers have uncovered a sneaky malicious npm campaign, dubbed PromptMink, linked to North Korean hackers Famous Chollima, which targets crypto developers with fake utility packages that secretly steal sensitive info and funds. The campaign's clever tactics even involve an AI-assisted code commit to fly under the radar.

https://osintsights.com/ai-assisted-code-targets-crypto-wallets-via-malicious-npm-dependency?utm_source=mastodon&utm_medium=social

#MaliciousNpmDependency #AiassistedCode #CryptoWallets #FamousChollima #Apt37

Contagious Interview diventa un worm: Void Dokkaebi trasforma 750 repository in vettori auto-propaganti contro gli sviluppatori

https://insicurezzadigitale.com/contagious-interview-diventa-un-worm-void-dokkaebi-trasforma-750-repository-in-vettori-auto-propaganti-contro-gli-sviluppatori/

Tracking DPRK operator IPs over time
#FAMOUSCHOLLIMA
https://kmsec.uk/blog/dprk-opsec-3/

RE: https://social.troll.academy/@mushu/115937976404644181

https://runjak.codes/posts/2026-01-21-adversarial-coding-test/

Seems really similar to a recently reported variant of a North Korean state aligned campaign, ContagiousInterview. They've moved to VS Code tasks now

cc @lazarusholic

https://www.jamf.com/blog/threat-actors-expand-abuse-of-visual-studio-code/
https://opensourcemalware.com/blog/contagious-interview-vscode

#DPRK #ContagiousInterview #lazarus #LazarusGroup #FamousChollima

Interview with the Chollima V
#FAMOUSCHOLLIMA
https://quetzal.bitso.com/p/interview-with-the-chollima-v

North Korean Hackers Caught on Video Using AI Filters in Fake Job Interviews https://hackread.com/north-korean-hackers-video-ai-filter-fake-job-interview/ #FamousChollima #ScamsandFraud #Cybersecurity #CyberAttack #QuetzalTeam #CyberCrime #NorthKorea #JobScam #Lazarus #Privacy #Fraud #Scam

Watch as North Korean hackers from the #FamousChollima group are caught using AI deepfakes and stolen identities in fake job interviews to infiltrate crypto and #Web3 firms.

Details: https://hackread.com/north-korean-hackers-video-ai-filter-fake-job-interview/

#CyberSecurity #CyberCrime #NorthKorea #Lazarus #Scam #AI

BeaverTail and OtterCookie evolve with a new Javascript module
#BeaverTail #OtterCookie #FAMOUSCHOLLIMA
https://blog.talosintelligence.com/beavertail-and-ottercookie/

Watch out as the North Korean hackers from the #FamousChollima group are using fake job offers to spread BeaverTail and OtterCookie malware, stealing crypto and credentials in a new attack.

Read: https://hackread.com/nk-famous-chollima-beavertail-ottercookie-malware/

#Cybersecurity #Malware #BeaverTail #OtterCookie #NorthKorea

Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure
#BeaverTail #InvisibleFerret #FAMOUSCHOLLIMA
https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/north-korean-malware-sept-2025/

Famous Chollima deploying Python version of GolangGhost RAT
#FAMOUSCHOLLIMA #GolangGhost
https://blog.talosintelligence.com/python-version-of-golangghost-rat/

N. Korean Hackers Use PylangGhost Malware in Fake Crypto Job Scam https://hackread.com/n-korean-hackers-pylangghost-malware-crypo-job-scam/ #Cryptocurrency #FamousChollima #ScamsandFraud #Cybersecurity #CyberAttack #GolangGhost #PylangGhost #Blockchain #CyberCrime #NorthKorea #Security #security #Malware #Python

🚨 North Korean hackers from #FamousChollima group are using fake crypto job interviews to spread a new malware called #PylangGhost, targeting blockchain pros.

Details: https://hackread.com/n-korean-hackers-pylangghost-malware-crypo-job-scam/

#CyberSecurity #NorthKorea #CyberCrime #Malware