{
  "name": "From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic",
  "slug": "from-contagious-to-clickfake-interview-lazarus-leveraging-the-clickfix-tactic",
  "description": "Lazarus, a North Korean state-sponsored threat actor, has launched a new campaign called ClickFake Interview targeting cryptocurrency job seekers. This campaign, an evolution of the previously documented Contagious Interview, uses fake job interview websites to deploy the GolangGhost backdoor on Windows and macOS systems. The infection chain leverages the ClickFix tactic, downloading and executing malicious payloads during the interview process. The campaign primarily targets centralized finance (CeFi) entities, aligning with Lazarus' focus on cryptocurrency-related targets. Notable changes include targeting non-technical roles and using ReactJS-based websites for the fake interviews. The malware provides remote control and data theft capabilities, including browser information exfiltration.",
  "published": "2025-04-01T12:59:29+00:00",
  "created_at": "2025-04-01T12:59:29+00:00",
  "modified_at": "2025-04-01T13:31:28+00:00",
  "created_at_opencti": "2025-04-01T12:59:29+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-04-01",
    "backdoor",
    "cefi",
    "clickfix",
    "cryptocurrency",
    "frostyferret",
    "golangghost",
    "job interviews",
    "north korea"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "72.5.42.93"
      },
      {
        "id": "",
        "name": "38.134.148.218"
      },
      {
        "id": "",
        "name": "154.62.226.22"
      },
      {
        "id": "",
        "name": "https://www.archblock.com"
      },
      {
        "id": "",
        "name": "https://api.smartdriverfix.cloud/nvidiawins-update"
      },
      {
        "id": "",
        "name": "https://api.smartdriverfix.cloud/nvidiadrivers-kp9s.update"
      },
      {
        "id": "",
        "name": "https://api.smartdriverfix.cloud/coremedia-kp9s.sh"
      },
      {
        "id": "",
        "name": "http://72.5.42.93:8080"
      },
      {
        "id": "",
        "name": "http://38.134.148.218:8080"
      },
      {
        "id": "",
        "name": "http://154.62.226.22:8080"
      },
      {
        "id": "",
        "name": "api.webcamwizard.cloud"
      },
      {
        "id": "",
        "name": "api.webcamdrivers.cloud"
      },
      {
        "id": "",
        "name": "api.web-cam.cloud"
      },
      {
        "id": "",
        "name": "api.vidtechhub.cloud"
      },
      {
        "id": "",
        "name": "api.videotechdrivers.cloud"
      },
      {
        "id": "",
        "name": "api.videodriverzone.cloud"
      },
      {
        "id": "",
        "name": "api.videocarddrivers.cloud"
      },
      {
        "id": "",
        "name": "api.vcamdriverupdate.cloud"
      },
      {
        "id": "",
        "name": "api.smartdriverfix.cloud"
      },
      {
        "id": "",
        "name": "api.nvidia-release.us"
      },
      {
        "id": "",
        "name": "api.provideodrivers.cloud"
      },
      {
        "id": "",
        "name": "api.nvidia-release.org"
      },
      {
        "id": "",
        "name": "api.nvidia-drive.cloud"
      },
      {
        "id": "",
        "name": "api.driverstream.cloud"
      },
      {
        "id": "",
        "name": "api.driversnap.cloud"
      },
      {
        "id": "",
        "name": "api.drivercams.cloud"
      },
      {
        "id": "",
        "name": "api.drivercamhub.cloud"
      },
      {
        "id": "",
        "name": "api.drive-release.cloud"
      },
      {
        "id": "",
        "name": "api.camtechdrivers.com"
      },
      {
        "id": "",
        "name": "api.camera-drive.org"
      },
      {
        "id": "",
        "name": "api.camdriverstore.cloud"
      },
      {
        "id": "",
        "name": "api.camdriversupport.com"
      },
      {
        "id": "",
        "name": "api.camdrivers.cloud"
      },
      {
        "id": "",
        "name": "zenspiretech.com"
      },
      {
        "id": "",
        "name": "api.camdriverhub.cloud"
      },
      {
        "id": "",
        "name": "vidintermaster.com"
      },
      {
        "id": "",
        "name": "videorecruitpro.com"
      },
      {
        "id": "",
        "name": "vidhirehub.com"
      },
      {
        "id": "",
        "name": "vidcruitermaster.com"
      },
      {
        "id": "",
        "name": "vidcruiterinterview.com"
      },
      {
        "id": "",
        "name": "vidassesspro.com"
      },
      {
        "id": "",
        "name": "vidassess360.com"
      },
      {
        "id": "",
        "name": "vid-crypto-assess.com"
      },
      {
        "id": "",
        "name": "ugethired360.com"
      },
      {
        "id": "",
        "name": "toptalentassess.com"
      },
      {
        "id": "",
        "name": "test-wolf.com"
      },
      {
        "id": "",
        "name": "talentsnaptest.com"
      },
      {
        "id": "",
        "name": "talentview360.com"
      },
      {
        "id": "",
        "name": "talenthiring360.com"
      },
      {
        "id": "",
        "name": "skillprooflab.com"
      },
      {
        "id": "",
        "name": "talentcheck.pro"
      },
      {
        "id": "",
        "name": "skillhiretrack.com"
      },
      {
        "id": "",
        "name": "quickinterview360.com"
      },
      {
        "id": "",
        "name": "quickskill-review.com"
      },
      {
        "id": "",
        "name": "quickhire360.com"
      },
      {
        "id": "",
        "name": "quickassessio.com"
      },
      {
        "id": "",
        "name": "process.name"
      },
      {
        "id": "",
        "name": "livehirehub.com"
      },
      {
        "id": "",
        "name": "jobinterview360.com"
      },
      {
        "id": "",
        "name": "intervwolf.com"
      },
      {
        "id": "",
        "name": "host.name"
      },
      {
        "id": "",
        "name": "evalvidz.com"
      },
      {
        "id": "",
        "name": "evalswift.com"
      },
      {
        "id": "",
        "name": "evalassesso.com"
      },
      {
        "id": "",
        "name": "eskillprof.com"
      },
      {
        "id": "",
        "name": "devchallengehq.com"
      },
      {
        "id": "",
        "name": "competency-core.com"
      },
      {
        "id": "",
        "name": "coinbase-walet.me"
      },
      {
        "id": "",
        "name": "coinbase-walet.biz"
      },
      {
        "id": "",
        "name": "candidateinsightinfo.com"
      },
      {
        "id": "",
        "name": "blockchainjobhub.com"
      },
      {
        "id": "",
        "name": "blockchainjobassessment.com"
      },
      {
        "id": "",
        "name": "blockassess.com"
      },
      {
        "id": "",
        "name": "assessiohq.com"
      },
      {
        "id": "",
        "name": "f4b4411e403dd5094eef9c8946522fc9a99cf1676c8de5926b3c343264b126e6"
      },
      {
        "id": "",
        "name": "ef9f49f14149bed09ca9f590d33e07f3a749e1971a31cb19a035da8d84f97aa0"
      },
      {
        "id": "",
        "name": "e88700d069a856e1a16c0da317a6f18fa626dd2d46dcbee1a7403d2e2d9ed097"
      },
      {
        "id": "",
        "name": "e52118fc7fc9b14e5a8d9f61dfae8b140488ae6ec6f01f41d9e16782febad5f2"
      },
      {
        "id": "",
        "name": "d00ca82a32b5e8063492f27dfec225b0888cd6135db3e2af65be3782bbfa16e5"
      },
      {
        "id": "",
        "name": "ba81429101a558418c80857781099e299c351b09c8c8ad47df2494634a5332dc"
      },
      {
        "id": "",
        "name": "b7b9e7637a42b5db746f1876a2ecb19330403ecb4ec6f5575db4d94df8ec79e8"
      },
      {
        "id": "",
        "name": "a803c043e12a5dac467fae092b75aa08b461b8e9dd4c769cea375ff87287a361"
      },
      {
        "id": "",
        "name": "6e186ada6371f5b970b25c78f38511af8d10faaeaed61042271892a327099925"
      },
      {
        "id": "",
        "name": "887189269c3594e1a851eb22f7c174a7c28618114b7dbaab6b645f34bd809f5a"
      },
      {
        "id": "",
        "name": "6289ef57b1772d78da0e54ba4730b6fc79f5ec1620ff63c3abaebea70190eba9"
      },
      {
        "id": "",
        "name": "3fec701b5e8486081c7062590f4ff947fcf51246cb067f951e90eb43dad930b4"
      }
    ],
    "malware": [
      {
        "id": "2b43589a-522b-432c-a767-556b12c36051",
        "name": "FrostyFerret",
        "slug": "frostyferret"
      },
      {
        "id": "e069a458-fd52-487f-83df-58a900107e48",
        "name": "GolangGhost",
        "slug": "golangghost"
      }
    ],
    "intrusion_sets": [
      {
        "id": "d84018a2-9bb1-45dd-94a2-38a8deb013c0",
        "name": "Lazarus",
        "slug": "lazarus"
      }
    ],
    "attack_patterns": [
      {
        "id": "f4a450ef-8297-42e5-9e47-01162138baa2",
        "name": "T1115"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "6efb8bea-11d7-418d-a429-9f4a3e6c50f6",
        "name": "T1087"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Finance"
      }
    ]
  },
  "external_refs": [
    "https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/",
    "https://otx.alienvault.com/pulse/67ebff51da5765b1e4d9509e"
  ]
}