Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025
ClickFake Interview campaign (ClickFix tactic; GolangGhost, FrostyFerret) · February 2025
(MSMT/2025/2, report p. 37-38) “In February 2025, a malicious campaign targeting job seekers in the cryptocurrency industry with fake job interview websites was discovered and dubbed “ClickFake Interview.” It represents an evolution of the Contagious Interview campaign. This new variant leverages fake job interview websites to deploy the ClickFix tactic and install Windows and macOS backdoors targeting cryptocurrency industry professionals.” p. 38: lure company names included “Coinbase, KuCoin, Kraken, Circle, Securitize, BlockFi, Tether, Bybit, and Robinhood” and “Archblock”.