Crypto Wasted: BlueNoroff’s Ghost Mirage of Funding and Jobs | Sojun Ryu & Omar Amin

Threat Group Context

Sojun Ryu and Omar Amin from Kaspersky track BlueNoroff (APT38), linked to the 2016 Bangladesh Bank heist. They describe two 2024-style campaigns: Ghost Hire targeting executives and GhostScore targeting developers.

Ghost Hire Fake Meetings

Attackers compromise a contact list, pose as partners, and invite victims to calendar meetings. Links masquerade as Zoom but abuse Telegram hyperlink masking; fake rooms record victims, freeze video, and push malicious SDK updates or click-to-run commands on macOS and Windows.

Post-Compromise Tooling

Compiled scripts pull multi-stage payloads including Swift credential harvesters, browser and extension stealers, keychain exfiltration, and broad secret scraping from npm, GitHub, AWS, and password managers. Operators even use AI to enhance victim photos for later impersonation.

GhostScore Developer Lures

GhostScore contacts engineers on Telegram with fake recruiter personas and timed coding assessments. Malicious Node and TypeScript projects pull trojanized dependencies from npm-like hosts, evade 360 Total Security when present, and deliver follow-on PowerShell or VBScript stages to fully compromise targets.