GolangGhost (Windows)
Aliases: BitStep RAT, WeaselStore
- First seen
- 2023-05-01 00:00:00
- Malware type
- rat
- Profile updated
- 2026-07-07 13:15:01
Targeted industries: financial-services technology-and-telecommunications
Targeted regions: country_code:kr
Context
GolanGhost is a RAT written in Go. It uses C2 to receive commands and exfiltrate data such as browser information targeting especially installed cryptocurrency wallets. It is often used in ClickFix campaigns by North-Korean threat actors.
Reports & references
- abstract.security — Contagious Interview Evolution Of Vscode And Cursor Tasks Infection Chains (report)
- www-cdn.anthropic.com — B2A76C6F6992465C09A6F2Fce282F6C0Cea8C200 (report)
- ESET — Deceptivedevelopment From Primitive Crypto Theft To Sophisticated Ai Based Deception (report)
- gitlab-com.gitlab.io — North Korean Malware Sept 2025 (report)
- silentpush.com — Contagious Interview Front Companies (report)
- recordedfuture.com — Purplebravos Targeting It Software Supply Chain (report)
- virusbulletin.com — Deceptivedevelopment And North Korean It Workers From Primitive Crypto Theft To Sophisticated Ai Based Deception (report)
- web-assets.esetstatic.com — Eset Apt Activity Report Q4 2024 Q1 2025 (report)
- any.run — Pylangghost Malware Analysis (report)
- blog.sekoia.io — Clickfake Interview Campaign By Lazarus (report)
- blog.polyswarm.io — Famous Chollimas Pylangghost (report)
- abstract.security — Contagious Interview Evolution Of Vs Code And Cursor Tasks Infection Chains Part 2 (report)
- Cisco Talos — Python Version Of Golangghost Rat (report)
- wiz.io — North Korean Tradertraitor Crypto Heist (report)
- Microsoft — Contagious Interview Malware Delivered Through Fake Developer Job Interviews (report)
- sophos.com — Nickel Alley Strategy Fake It Til You Make It (report)
- Trend Micro — Russian Infrastructure North Korean Cybercrime (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Golangghost (report)