Famous Chollima deploying Python version of Golang Ghost RAT
Summary: Cisco Talos reported that since May 2025 the North Korean-aligned group Famous Chollima has deployed a Python variant of its GolangGhost remote access trojan, which Talos calls PylangGhost, delivered through fake skill-testing pages impersonating companies such as Coinbase, Archblock, Robinhood, Parallel Studios and Uniswap. The trojan runs from a file named nvidia.py, persists via a registry value, communicates with its command-and-control server over HTTP with RC4 encryption, and steals cookies and credentials from more than 80 browser extensions including Metamask, 1Password, NordPass, Phantom, Bitski, Initia, TronLink and MultiverseX.
What you should know: The lure is a job interview: engineers with cryptocurrency and blockchain experience are told to paste a command to install video drivers, and that command installs a RAT that reaches into more than 80 browser extensions, including the crypto wallets and password managers those same candidates use.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026