Phishing Documented incident

Contagious Interview / ClickFake: North Korea's fake crypto job interviews (2025)

North Korea-linked hackers ran fake job interviews for crypto firms, then told applicants to paste a 'camera fix' that installed malware. How ClickFake works.

Social Engineering Examples·12 sources

North Korea-linked operators built polished fake job-interview sites in the name of crypto companies such as Coinbase, Kraken and Circle. Applicants filled in forms, answered screening questions, then were asked to record a video introduction. When they turned on their camera, the site showed a fake driver error and told them to paste a "fix" into their computer's terminal. That command installed a backdoor called GolangGhost. Security firm Sekoia named this branch "ClickFake Interview" in early 2025. Status: Documented campaign, vendor research.

Key takeaways

The victim runs the malware themselves, believing they're fixing a camera problem. This is the ClickFix trick.
None of the advertised roles were developer jobs. They were business development, product and DeFi roles, aimed at people less likely to spot a bad command.
On Macs, a second fake pop-up asked for the system password.
No campaign-wide loss figure exists. The two reported losses are individual claims.

How the fake interview worked

Step	What the candidate saw
Approach	A recruiter, often on LinkedIn or a job board, offering a good role at a crypto firm
Application	A professional-looking site with forms and screening questions
Video intro	A request to turn on camera and microphone, which is normal in real hiring
Fake error	A message blaming a camera driver fault
"Fix"	Instructions to open Terminal (Mac) or Command Prompt (Windows) and paste a command, presented as an NVIDIA or FFMPEG driver update
Infection	The command quietly downloaded and ran GolangGhost, a backdoor that also steals data

On Macs, a credential stealer called FrostyFerret ran first and put up a fake system dialog asking for the user's password. If the site detected the wrong kind of visitor, such as a security scanner, it served a harmless decoy instead.

Tip: no real website needs you to paste a command into your terminal to fix your camera. If a page asks, close it.

How the campaign changed

Period	Targets	Method
From December 2022 (Unit 42, "Contagious Interview")	Developers	Fake "take-home tests" with backdoored code on NPM or GitHub
From early 2025 (Sekoia, "ClickFake Interview")	Non-technical crypto roles	Fake interview sites and a paste-this-command fix

Sekoia found 184 invitations naming 14 companies, including Coinbase, KuCoin, Kraken, Circle, Securitize, BlockFi, Tether, Bybit, Robinhood and Archblock. None of these firms was involved; their names were used as bait. SentinelLABS and Validin later recovered logs naming more than 230 people who engaged with the lures in early 2025, from only a few servers, and said the true number is likely much higher.

Front companies

Silent Push found three fronts used to make the scheme look real: BlockNovas LLC, Angeloper Agency and SoftGlide LLC. Reuters reported that BlockNovas and SoftGlide were registered as real US companies using fake identities. The operators used AI image tools to make fake staff headshots. The FBI seized the BlockNovas domain in April 2025.

Two loss reports exist, both single claims. Reuters quoted an anonymous product manager who lost about $1,000 in crypto after recording a video intro for a fake Ripple recruiter. Silent Push mentioned a developer whose wallet was allegedly emptied, though that person's own account describes the older code-test method.

Who is behind it

Researchers tie the campaign to North Korea, though they describe it differently. Palo Alto's Unit 42 attributed it with moderate confidence to a North Korean state-sponsored group. Sekoia names Lazarus directly. Silent Push calls it a Lazarus subgroup also known as Famous Chollima. It's part of the same playbook as the Axie Infinity heist, where a fake job offer led to a $540 million theft.

What stops it

Never paste commands from a website into your terminal or Run box.
Check the employer through its official careers page before going further.
Use a separate device for job hunting, away from wallets and work systems.
Be wary of fast, generous offers from recruiters you didn't approach.
Companies: block or alert on terminal commands launched from the Run box or browser, and log PowerShell.

See also recruitment fraud and spear phishing.

Common questions

What is the Contagious Interview campaign?

A North Korea-linked operation that uses fake job interviews to get crypto-industry job seekers to install malware.

What is ClickFake Interview?

Sekoia's name for a 2025 branch of the campaign that uses fake interview websites and a "paste this command to fix your camera" trick.

Were Coinbase or Kraken hacked?

No. Their names were used on fake interview sites to attract applicants.

How much money was stolen?

No campaign-wide figure exists. Individual reported losses include about $1,000 in crypto from one victim quoted by Reuters.

Sources

Lazarus ClickFake Interview Campaign: ClickFix Malware. Sekoia (primary).
From Contagious to ClickFake Interview (full report, TLP:CLEAR). Sekoia (primary).
Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware. Palo Alto Networks Unit 42 (primary).
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Palo Alto Networks Unit 42 (primary).
Silent Push uncovered Contagious Interview front company scam. Silent Push (primary).
Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms. SentinelLABS and Validin, 4 September 2025 (primary).
North Korean cyber spies created U.S. firms to dupe crypto developers. Reuters (secondary).
OtterCookie, new malware used in Contagious Interview campaign. NTT Security Holdings (primary).
macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed. SentinelOne (primary).
Lazarus Uses ClickFix Tactics in Fake Cryptocurrency Job Attacks. SecurityWeek, 2 April 2025 (secondary). Cited for the impersonated brands read off Sekoia's chart, Ripple and Chainalysis.
How North Korean hackers are using fake job offers to steal cryptocurrency. Reuters, 4 September 2025 (secondary). Cited for the single self-reported $1,000 loss on the ClickFix vector.
North Korea-linked threat actors utilize falsified companies and job interviews to distribute malware. Hogan Lovells, 8 May 2025 (secondary). Cited for the April 23, 2025 BlockNovas seizure date.

Cite this case

Social Engineering Examples. “Contagious Interview / ClickFake: North Korea's fake crypto job interviews (2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/contagious-interview-clickfake-crypto-2025

Attack Chain & Defense

1Front-company and persona setup

What happened

DPRK operators stood up three front companies, documented by Silent Push as BlockNovas LLC, Angeloper Agency and SoftGlide LLC. Two of them were genuine US registrations obtained with fake personas and addresses: Reuters reviewed the documents and places BlockNovas in New Mexico and SoftGlide in New York, while Angeloper Agency "does not appear to be registered in the United States." The operators then built fake recruiter and employee profiles on LinkedIn and other platforms, using AI image-generation services, Silent Push names "Remaker AI", to manufacture employee headshots.