Ingram Micro, one of the world’s largest IT distribution and services companies, has confirmed it was targeted in a ransomware attack by t...
A new online scam is targeting people who work in the cryptocurrency industry, using fake job offers and interviews to trick them into installing harmful software on their devices.
According to a report by cybersecurity researchers at Cisco Talos, the attack involves a new type of malware called PylangGhost. It is a remote access tool also known as a trojan, built using the Python programming language. Once installed, it allows attackers to secretly control the victim’s computer and steal private data like passwords and session cookies.
The people behind the scam are believed to be tied to North Korean hacking groups, who have been linked to several past cryptocurrency-related cybercrimes. This time, they are pretending to be recruiters from well-known companies like Coinbase, Uniswap, and Robinhood to appear trustworthy.
How the Scam Works
The attackers set up fake job websites that look like they belong to real crypto companies. They then contact professionals in the industry, especially those with experience in blockchain development and invite them to apply for jobs.
Victims are asked to complete technical assessments and share personal details, believing it's part of the interview process. Later, they’re told to prepare for a video interview and are asked to install what is described as a “video driver” to improve camera quality. However, this download is actually the PylangGhost malware.
Once installed, the software can:
1. Steal login credentials from over 80 browser extensions (such as MetaMask, Phantom, and 1Password).
2. Allow attackers to access and control the computer remotely.
3. Stay hidden and continue running even after a system reboot.
Real-World Examples
Researchers say this method has already been used in India and other countries. Similar scams in the past included fake companies like “BlockNovas LLC” and “SoftGlide LLC,” which were created to look legitimate. In one case, the FBI had to shut down one of these websites.
In another incident, engineers at the crypto exchange Kraken discovered that one job applicant was a North Korean hacker. The person was caught when they failed basic identity checks during an interview.
The malware also has a history. PylangGhost is the Python version of an earlier program called GolangGhost, which was used to target macOS systems. The newer version is now aimed specifically at Windows users, while Linux systems appear unaffected for now.
Security Experts Call for Action
Cybersecurity experts in India say this growing threat should be taken seriously. Dileep Kumar H V, director at Digital South Trust, has recommended:
• Regular cybersecurity audits for blockchain firms.
• Stronger legal protections under India’s IT Act.
• National awareness campaigns and better monitoring of fake job portals.
He also stressed the need for international coordination, urging agencies like CERT-In, MEITY, and NCIIPC to work together with global partners to counter these attacks.
Why It Matters
These scams reflect a shift in tactics and deployment of new technologies, from hacking exchanges to targeting individuals. By stealing credentials or gaining insider access, attackers may be trying to infiltrate companies from within. As the crypto industry continues to expand and transcend boundaries, so do the risks, thus making awareness and vigilance more critical than ever.
Most of the victims were based in India, Argentina, Peru, Mexico, Colombia, Bolivia, and Ecuador. A few records date back to 2018. The leaked database also revealed the identity of the Catwatchful admin called Omar Soca Char.
The Catwatchful database also revealed the identity of the spyware operation’s administrator, Omar Soca Charcov, a developer based in Uruguay.
Catwatchful is a spyware that pretends to be a child monitoring app, claiming to be “invisible and can not be detected,” while it uploads the victim’s data to a dashboard accessible to the person who planted the app. The stolen data includes real-time location data, victims’ photos, and messages. The app can also track live ambient audio from the device’s mic and access the phone camera (both front and rear).
Catwatchful and similar apps are banned on app stores, and depend on being downloaded and deployed by someone having physical access to a victim’s phone. These apps are famous as “stalkerware” or “spouseware” as they are capable of unauthorized and illegal non-consensual surveillance of romantic partners and spouses.
The Catwatchful incident is the fifth and latest in this year’s growing list of stalkerware scams that have been breached, hacked, or had their data exposed.
Daigle has previously discovered stalkerware exploits. Catwatchful uses a custom-made API, which the planted app uses to communicate to send data back to Catwatchful servers. The stalkerware also uses Google Firebase to host and store stolen data.
According to Techradar, the “data was stored on Google Firebase, sent via a custom API that was unauthenticated, resulting in open access to user and victim data. The report also confirms that, although hosting had initially been suspended by HostGator, it had been restored via another temporary domain."
Shimla, June 10 — The official website of Himachal Pradesh University (HPU) experienced an unexpected breach earlier this week, when its homepage was briefly altered to display inappropriate and anti-national content. The incident prompted immediate action, with the university taking the website offline to prevent further misuse.
Authorities confirmed that unidentified individuals had gained access to the homepage, where they replaced the usual university interface with content that included offensive language and visuals critical of national values. While the site was swiftly removed from public view for technical checks and repairs, no formal complaint had been filed by university officials at the time of reporting.
In response to the cyber intrusion, law enforcement has begun a preliminary investigation. A senior police official confirmed that two cybercrime specialists will visit the university on Tuesday. Their role will be to examine how the breach occurred, gather digital evidence, and determine the extent of the incident. They will also review the university’s existing cybersecurity framework to help prevent similar attacks in the future.
Although there has been no indication that internal systems or user data were compromised, the defacement itself raises concerns about the digital safety of public institutions. Experts note that universities, while not typical targets of large-scale cybercrime, are still vulnerable due to often limited technical infrastructure and cybersecurity awareness.
Incidents like this are typically aimed at spreading propaganda or drawing attention through disruption. They also highlight the urgent need for academic institutions to invest in stronger online defenses, including regular system audits, software updates, and basic cyber hygiene practices.
The university’s website is expected to be restored after thorough security checks are completed. Authorities have assured that any future developments in the investigation will be made public through official channels.
As cyber threats grow more frequent and intricate, this incident stands as a reminder of the importance of proactive digital security, even in the education sector.