North Korea's 'Contagious Interview' ClickFix Fake Job-Assessment Campaign Targets Crypto Industry (2025)

What Happened

North Korea-linked operators ran a long-running fake-hiring operation against software developers and crypto-industry job seekers. Unit 42 first publicly documented the cluster in November 2023 as 'Contagious Interview' (tracked internally as CL-STA-0240), finding it active since at least December 2022: fake recruiters approached developers on job platforms and pushed them to download 'take-home assessment' code hosted on NPM or GitHub that was secretly backdoored, dropping the JavaScript malware BeaverTail which then loaded the Python backdoor InvisibleFerret. In February 2025, Sekoia identified a new, more polished branch of the same campaign, which it named 'ClickFake Interview,' notifying customers on March 21, 2025 and publishing full findings on March 31, 2025. In this variant the operators built professional ReactJS-based fake interview/application websites explicitly themed around cryptocurrency employers, had candidates fill out application forms and screening questions, and then asked them to record a video introduction. When the applicant tried to enable their camera or microphone, the site displayed a fabricated driver or permissions error and instructed them to fix it by copy-pasting and running a command in their Terminal (macOS) or Command Prompt/PowerShell (Windows), the 'ClickFix' social-engineering technique. Running that command silently fetched and executed malware: a Windows chain using curl, PowerShell, VBS and NodeJS to install the Go-based backdoor GolangGhost, and a macOS chain using Bash and LaunchAgents to install FrostyFerret before also landing GolangGhost. Follow-on research (Silent Push, April 24, 2025) identified three North-Korean-run front companies used to lend the scheme legitimacy: BlockNovas LLC, Angeloper Agency, and SoftGlide LLC. Silent Push also found the operators using AI image-generation tools (branded 'Remaker AI') to create fake employee headshots for these front companies, and confirmed at least one victim whose MetaMask wallet was compromised. The FBI subsequently seized the BlockNovas domain on April 23-24, 2025 as part of a law enforcement action against the North Korean operators, per Reuters reporting. SentinelOne/Validin later found exposed operator infrastructure showing more than 230 individuals had engaged with Contagious Interview lures between January and March 2025. Security researchers, including NTT Security Holdings and SentinelOne, subsequently described additional 2025-era backdoor variants in the same campaign ecosystem, including OtterCookie (tracked by NTT Security Holdings since around September 2024) and FlexibleFerret (documented by SentinelOne in February 2025).

How the Attack Worked

The attack chain combined classic recruitment social engineering with the ClickFix execution trick. Victims were approached by a fake recruiter (often via LinkedIn or job boards) offering a lucrative role, frequently at a real or front cryptocurrency company. They were funneled to a bespoke, professionally built interview/assessment website rather than a generic phishing page, which included application forms and screening questions to build legitimacy and investment in the process. The pivotal step came when the site asked the candidate to enable their webcam/microphone for a video introduction, a completely normal request in real hiring, and then displayed a fake error message claiming a camera driver or browser permission problem. The fix it offered was to open a terminal or command prompt and paste in a short command 'to resolve the issue.' Because the victim believed they were troubleshooting a benign hardware/software glitch rather than executing untrusted code, they ran the command themselves, bypassing the security instincts that would normally flag an unsolicited executable or attachment. That command triggered a multi-stage download-and-execute chain (curl/PowerShell/VBS/NodeJS on Windows; Bash/LaunchAgents on macOS) that installed persistent backdoors (GolangGhost, FrostyFerret) giving the attackers remote access, credential and wallet-data theft capability, and a foothold for further compromise. The older, parallel Contagious Interview vector used the same recruiter-lure premise but delivered its payload via a trojanized 'coding assessment' GitHub/NPM repository instead of a live website error dialog.

The Lure & the Tell

The lure was an entirely plausible, high-production-value hiring funnel: real-looking job listings, a recruiter persona, application forms, and a slick React-built assessment site themed on a known crypto brand (Coinbase, Kraken, Circle, etc.). The 'tell' for a wary victim was that no legitimate video-interview or coding-assessment platform ever needs the candidate to open a terminal and paste a command to fix a camera error; any prompt instructing a user to copy-paste and execute commands to resolve a webpage error is a ClickFix technique, regardless of how convincing the surrounding hiring process is.

Outcome

The technique successfully installed backdoors (GolangGhost, FrostyFerret, and in the original variant BeaverTail/InvisibleFerret) on victim machines, giving DPRK operators remote access and the ability to steal browser/wallet credentials and exfiltrate data. Researchers (Silent Push) confirmed at least one victim's MetaMask crypto wallet was compromised, though the reported loss was described as minor and no industry-wide dollar total has been established. Security firms and law enforcement disrupted parts of the infrastructure: Silent Push exposed three front companies (BlockNovas LLC, Angeloper Agency, SoftGlide LLC) and published indicators of compromise, and the FBI seized the BlockNovas domain in April 2025 as part of a law enforcement action against the North Korean operators, per Reuters reporting. SentinelOne/Validin separately found exposed operator logs showing over 230 people had interacted with the lures in a three-month window (January to March 2025), giving a rare window into campaign scale even without a public financial-loss tally.

Why It Matters

This case shows a nation-state actor repurposing the ClickFix technique, normally seen in generic malvertising and fake-CAPTCHA scams, inside a much higher-trust context: a multi-week hiring and interview process specifically targeting people with access to cryptocurrency systems and developer credentials. It demonstrates that even technically sophisticated targets (software developers) can be persuaded to run destructive commands themselves when the request is wrapped in a mundane, expected troubleshooting moment, and that job-seeking itself has become a viable initial-access vector for state-sponsored crypto theft and espionage.

Defenses

Never copy-paste and execute terminal/PowerShell commands supplied by a website or recruiter to 'fix' a technical error, regardless of how legitimate the surrounding process looks; treat any request to run commands to resolve a camera/mic/driver issue as a red flag. Verify recruiters and interview platforms independently (confirm the company domain, cross-check the recruiter's identity through the employer's official channels) before installing software or running assessment code. Run coding-assessment or take-home projects in an isolated/sandboxed environment, not on a primary work or personal machine with access to crypto wallets or corporate credentials. Organizations should monitor for and block known Contagious Interview/ClickFake infrastructure and educate developer and crypto-adjacent staff specifically, since they are the deliberately targeted population.