A subgroup of the North Korea-linked hacker organization Lazarus set up three shell companies, two in the US, to deliver malware to unsuspecting users.

The three sham crypto consulting firms — BlockNovas, Angeloper Agency and SoftGlide — are being used by the North Korean hacker group Contagious Interview to distribute malware through fake job interviews, Silent Push Threat Analysts said in an April 24 report.

Silent Push senior threat analyst Zach Edwards said in an April 24 statement to X that two shell companies are registered as legitimate businesses in the United States.

“These websites and a huge network of accounts on hiring / recruiting websites are being used to trick people into applying for jobs,” he said.

“During the job application process an error message is displayed as someone tries to record an introduction video. The solution is an easy click fix copy and paste trick, which leads to malware if the unsuspecting developer completes the process.”

During the sham job interview, an error message is displayed, requiring the user to click, copy, and paste to fix it, which leads to the malware infection. Source: Zach Edwards

Three strains of malware — BeaverTail, InvisibleFerret and Otter Cookie — are being used according to Silent Push.

BeaverTail is malware primarily designed for information theft and to load further stages of malware. OtterCookie and InvisibleFerret mainly target sensitive information, including crypto wallet keys and clipboard data.

Silent Push analysts said in the report that hackers use GitHub, job listing’s and freelancer websites to look for victims.

AI used to create fake employees 

The ruse also involves the hackers using AI-generated images to create profiles of employees for the three front crypto companies and stealing images of real people.

“There are numerous fake employees and stolen images from real people being used across this network. We’ve documented some of the obvious fakes and stolen images, but it’s very important to appreciate that the impersonation efforts from this campaign are different,” Edwards said.

“In one of the examples, the threat actors took a real photo from a real person, and then appeared to have run it through an AI image modifier tool to create a subtly different version of that same image.”

Related: Fake Zoom malware steals crypto while it’s ‘stuck’ loading, user warns

This malware campaign has been ongoing since 2024. Edwards says there are known public victims.

Silent Push identified two developers targeted by the campaign; one of them reportedly had their MetaMask wallet compromised.

The FBI has since shut down at least one of the companies.

“The Federal Bureau of Investigation (FBI) acquired the Blocknovas domain, but Softglide is still live, along with some of their other infrastructure,” Edwards said.

At least three crypto founders have reported in March that they foiled an attempt from alleged North Korean hackers to steal sensitive data through fake Zoom calls.

Groups such as the Lazarus Group are the prime suspects in some of the biggest cyber thefts in Web3, including the Bybit $1.4 billion hack and the $600 million Ronin network hack.

Magazine: Lazarus Group’s favorite exploit revealed — Crypto hacks analysis