GolangGhost Steals Chrome Secrets and Targets MetaMask on macOS

A fake job interview campaign is infecting macOS devices with GolangGhost, a remote access trojan capable of stealing Chrome credentials, collecting cryptocurrency wallet data, and modifying permissions associated with the MetaMask browser extension.

The attackers approach cryptocurrency and Web3 professionals while posing as recruiters. They direct targets to convincing skill-assessment websites, manufacture a camera or microphone error, and persuade candidates to paste a supposed repair command into Terminal.

According to a SOCRadar investigation published on July 20, 2026, the operation delivers GolangGhost to macOS systems and PylangGhost to Windows devices. Researchers associate the campaign with Famous Chollima, also known as Wagemole, a North Korean-aligned threat cluster.

How the fake interview installs GolangGhost

The infection begins with an unsolicited job opportunity, often promoted through LinkedIn, Discord, Telegram, or email. The recruiters may impersonate established cryptocurrency businesses, human resources platforms, or investment firms.

Targets receive individual links to online assessments that collect names, email addresses, phone numbers, work histories, and social media profiles. The sites also fingerprint the browser, operating system, screen resolution, timezone, and other device details.

The assessment includes role-specific questions, countdown timers, tab-switch warnings, and a final video-recording stage. These features create urgency and make the fraudulent process resemble a legitimate remote interview.

Attack stage	What the victim sees	What happens in the background
Recruiter contact	A high-paying crypto or Web3 role	The attacker builds trust and profiles the target
Skill assessment	Questions tailored to the advertised position	The site collects personal and device information
Video stage	A camera or microphone error	The attacker activates a fake troubleshooting prompt
Copy-and-paste fix	A harmless-looking driver command	The clipboard receives a malicious Terminal command
Payload execution	A background driver installation	GolangGhost, persistence files, and a credential harvester run

The clipboard hides the malicious Terminal command

At the final stage, the interview page claims that the camera cannot start without a graphics or video driver update. It displays troubleshooting instructions for the visitor’s operating system.

When the target copies the visible command, JavaScript intercepts the copy event and replaces the clipboard contents with a malicious command. The command includes an echoed version of the expected text, helping the resulting Terminal output appear legitimate.

This method belongs to the broader ClickFix family of social-engineering attacks. Microsoft’s Contagious Interview research has documented related recruitment schemes in which attackers persuade candidates to execute commands, install packages, or trust malicious development projects.

GolangGhost downloads its own Go compiler

On macOS, the pasted command downloads and runs a Bash script. The script creates a hidden working directory and retrieves an archive disguised as an Intel driver from a typosquatted Nvidia-themed domain.

The installer checks whether the Mac uses Apple silicon or an Intel processor. It then downloads the appropriate official Go compiler and extracts the required files into a hidden directory under /var/tmp.

The malware uses the locally downloaded compiler to run its Go source files. This approach removes the need for Go to be installed on the victim’s Mac before the attack begins.

A Launch Agent keeps the malware running

The installation script creates a Launch Agent named com.darwinstreamfixer.plist inside the user’s ~/Library/LaunchAgents directory. The file tells macOS to restart the malicious drivfixer.sh script after the user logs in.

GolangGhost then enters a command loop and communicates with its command-and-control server. Its modules can gather system information, upload and download files, execute shell commands, steal browser data, and return collected information to the attackers.

Earlier Cisco Talos research into GolangGhost found that the malware family shares its structure and commands with PylangGhost. Talos observed the Go version on macOS and the Python version on Windows.

Chrome secrets are extracted from the macOS Keychain

GolangGhost uses Apple’s security command-line utility to request the Chrome Safe Storage secret from the macOS Keychain. Chrome uses this secret when protecting locally stored browser information.

The malware derives the required decryption key through PBKDF2 and applies AES-CBC decryption to Chrome’s SQLite databases. This can expose locally stored credentials and session cookies to the attacker.

Stolen cookies may let attackers reuse active website sessions without entering the victim’s password again. The exact impact depends on the service, cookie validity, additional security checks, and whether the provider revokes the compromised session.

• Saved Chrome login credentials
• Browser session cookies
• Chrome profile and extension information
• Cryptocurrency wallet extension data
• Password manager extension data
• Files requested through remote commands

GolangGhost targets cryptocurrency wallet extensions

The browser-stealing module searches Chrome profiles for extensions associated with cryptocurrency wallets and password managers. Identified targets include MetaMask, Coinbase Wallet, Trust Wallet, Rabby Wallet, Phantom, TronLink, 1Password, and several other products.

Talos previously found that the related malware could collect credentials, cookies, and information from more than 80 browser extensions. The latest macOS variant retains broad wallet and browser collection capabilities.

Finding wallet extension files does not automatically reveal every wallet’s Secret Recovery Phrase. However, stolen browser sessions, local extension data, passwords, and remote access can give attackers several ways to target accounts or manipulate transactions.

MetaMask permissions can be modified

SOCRadar found a GolangGhost command that forcefully closes Chrome and edits its Secure Preferences JSON file. The malware inserts permissions that include activeTab, clipboardWrite, webRequest, and unlimitedStorage.

The altered configuration binds those permissions to the MetaMask extension. This could place the attacker in a stronger position to monitor browser activity, manipulate clipboard content, access web requests, or abuse extension storage, depending on Chrome’s enforcement and the victim’s configuration.

The finding does not mean that MetaMask itself contains a vulnerability. The malware first compromises the Mac and then tampers with browser configuration files on the infected device.

A fake macOS app also steals administrator credentials

The infection script launches an application named CodeFixerNow.app. Its associated SwiftUI dynamic library displays a fake software-update window that requests the victim’s macOS username and administrator password.

When the victim submits the form, the application combines the username and password and sends them to attacker-controlled infrastructure. This gives the attackers another route to privileged access even if browser credential theft fails.

The campaign therefore combines several techniques instead of depending on one exploit. It uses social engineering, Terminal execution, browser theft, persistence, wallet targeting, and direct password harvesting in the same infection chain.

Why crypto and Web3 workers face greater risk

The campaign targets developers and non-technical professionals who may control digital assets or have access to valuable company systems. Reported roles include investment partners, legal advisers, compliance officers, financial managers, product leaders, and business analysts.

A compromised personal Mac can expose an individual’s wallets and accounts. A compromised corporate Mac may also give attackers access to internal communication, source code, cloud services, customer information, and production infrastructure.

Recorded fake-interview campaigns have used similar methods for years. Microsoft recommends treating recruitment workflows as an attack surface and using isolated environments for interview projects, repositories, and technical assessments.

How organizations can reduce the risk

Companies should warn employees that legitimate recruiters should not require them to paste unexplained commands into Terminal or PowerShell. A camera problem should never require a candidate to install an unknown driver from an interview website.

Security teams should also monitor new Launch Agents, unexpected changes to Chrome preference files, suspicious use of the macOS security utility, Go compiler downloads, and processes launched from temporary directories.

Apple explains that macOS combines Gatekeeper, Notarization, and XProtect to prevent and remediate malicious software. However, Apple’s macOS security guidance cannot prevent every incident when a user deliberately pastes and runs an attacker-provided command.

• Do not conduct personal job interviews on privileged corporate devices.
• Never run commands supplied through an unexpected camera error.
• Verify recruiters through the employer’s official website and contact channels.
• Use an isolated virtual machine for untrusted coding or interview tasks.
• Review newly created files under ~/Library/LaunchAgents.
• Investigate unexpected modifications to Chrome’s Secure Preferences file.
• Use separate browser profiles for work, personal accounts, and cryptocurrency activity.
• Keep macOS, Chrome, security software, and wallet extensions updated.

What to do after a suspected GolangGhost infection

Anyone who pasted a recruitment site’s command into Terminal should immediately disconnect the Mac from the network. The user should avoid entering new passwords or creating a replacement wallet on the suspected device.

MetaMask advises victims of crypto job scams to power down the compromised device and move assets from another trusted device. If the Secret Recovery Phrase may have been exposed, users should create a new wallet with a new phrase and transfer remaining assets as quickly as possible.

Businesses should preserve evidence before rebuilding the machine. Security teams should collect relevant logs, inspect Launch Agents, review browser files, identify outbound connections, revoke active sessions, rotate credentials, and check other systems accessed from the Mac.

1. Disconnect the suspected Mac from Wi-Fi, Ethernet, and VPN connections.
2. Contact the organization’s security team or a qualified incident responder.
3. Use a separate trusted device to change important account passwords.
4. Revoke browser sessions, API tokens, cloud credentials, and application passwords.
5. Move cryptocurrency from potentially exposed wallets to a newly created wallet.
6. Review wallet approvals and recent transactions for unauthorized activity.
7. Reinstall macOS or restore the computer through an approved recovery process.

Users should not rely on deleting one script or Launch Agent. GolangGhost provides remote command execution and file-transfer capabilities, so attackers may install additional payloads after the first compromise.

Apple’s malware protection documentation describes the built-in safeguards available in macOS, but a confirmed remote-access infection warrants a complete investigation and trusted system recovery.

MetaMask’s job scam response guidance also warns against creating new passwords or wallets on the compromised computer. Attackers could capture those replacement credentials while malware remains active.

Selected GolangGhost indicators of compromise

The following indicators come from the latest SOCRadar threat report. Domains and addresses are defanged to prevent accidental access. Organizations should investigate them alongside behavioral evidence because infrastructure can change or serve unrelated content after a campaign ends.

Type	Indicator	Description
Domain	paxos-apply[.]com	Fake recruitment infrastructure
Domain	cameradriverupdates[.]com	Fake driver or recruitment infrastructure
Domain	breezyhr[.]us	Typosquatted recruitment platform
Domain	paxos-video-interviews[.]com	Fake interview infrastructure
Domain	evaluateproficiency[.]com	Fake assessment infrastructure
Domain	nvidiadriver[.]net	Payload-hosting domain
IP address	95[.]216[.]92[.]207	Command-and-control infrastructure
File path	~/Library/LaunchAgents/com.darwinstreamfixer.plist	macOS persistence file
SHA-256	0ca62fe52a895bad73a14f1a455e1bead18b8c256749d727c2678924298f7ee8	macPatch.sh
SHA-256	617779f417c1850c08ed55ba49e2317aed0e1e911fca8bf8f348189ee4ebdb97	drivfixer.sh
SHA-256	1cee591c63d7fd8ee963abb29789c3ee41eb42cc77470964a00ea15be4b51341	CodeFixerNow.app
SHA-256	9e465904503815c27397e082fd5ca8eb30d99d8d256c6a0949696d1830c8bb53	CodeFixerNow.debug.dylib

FAQ