North Korean Threat Actors Deploy PylangGhost and GolangGhost via Sophisticated Job Interview Scams
North Korean state-sponsored actors, identified as PurpleBravo and Chollima, are executing highly targeted social engineering campaigns against the IT software supply chain. Utilizing fake recruitment processes, attackers trick developers into executing malicious files disguised as technical coding assessments or job-related documentation. This campaign introduces PylangGhost, a Python-based evolution of the GolangGhost Remote Access Trojan (RAT), enabling cross-platform execution on both Windows and macOS. The deployment of these language-specific RATs facilitates long-term espionage, intellectual property theft, and lateral movement within sensitive development environments by leveraging the inherent trust in professional recruitment workflows and bypassing traditional detection through Go and Python implementations.